CVE-2010-4569

2011-01-2816:00:02

CWE-79

[email protected]

web.nvd.nist.gov

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.5

Confidence

High

EPSS

0.002

Percentile

64.5%

JSON

Cross-site scripting (XSS) vulnerability in Bugzilla 3.7.1, 3.7.2, 3.7.3, and 4.0rc1 allows remote attackers to inject arbitrary web script or HTML via the real name field of a user account, related to the AutoComplete widget in YUI.

Affected configurations

Nvd

Node

mozillabugzillaMatch3.7.1

mozillabugzillaMatch3.7.2

mozillabugzillaMatch3.7.3

mozillabugzillaMatch4.0rc1

VendorProductVersionCPE
mozillabugzilla3.7.1cpe:2.3:a:mozilla:bugzilla:3.7.1:*:*:*:*:*:*:*
mozillabugzilla3.7.2cpe:2.3:a:mozilla:bugzilla:3.7.2:*:*:*:*:*:*:*
mozillabugzilla3.7.3cpe:2.3:a:mozilla:bugzilla:3.7.3:*:*:*:*:*:*:*
mozillabugzilla4.0cpe:2.3:a:mozilla:bugzilla:4.0:rc1:*:*:*:*:*:*

Vendor	Product	Version	CPE
mozilla	bugzilla	3.7.1	cpe:2.3:a:mozilla:bugzilla:3.7.1:::::::*
mozilla	bugzilla	3.7.2	cpe:2.3:a:mozilla:bugzilla:3.7.2:::::::*
mozilla	bugzilla	3.7.3	cpe:2.3:a:mozilla:bugzilla:3.7.3:::::::*
mozilla	bugzilla	4.0	cpe:2.3:a:mozilla:bugzilla:4.0:rc1::::::