Test ID:	1.3.6.1.4.1.25623.1.0.803173
Category:	Web application abuses
Title:	Bugzilla Information Disclosure and Cross-Site Scripting Vulnerabilities
Summary:	Bugzilla is prone to information disclosure and cross site scripting vulnerabilities.
Description:	Summary: Bugzilla is prone to information disclosure and cross site scripting vulnerabilities. Vulnerability Insight: - Input passed to the 'id' parameter in show_bug.cgi (when 'format' is set to an invalid format) is not properly sanitized before being returned to the user. - An error related to running a query in debug mode can be exploited to disclose if certain field values exists. Vulnerability Impact: Successful exploitation will allow remote attackers to gain sensitive information and execute arbitrary HTML and script code in a users browser session in context of an affected site. Affected Software/OS: Bugzilla version 2.0 to 3.6.12, 3.7.1 to 4.0.9, 4.1.1 to 4.2.4 and 4.3.1 to 4.4rc1 Solution: Upgrade to Bugzilla 3.6.13, 4.0.10, 4.2.5, 4.4rc2 or later. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-0785 http://www.mandriva.com/security/advisories?name=MDVSA-2013:066 Common Vulnerability Exposure (CVE) ID: CVE-2013-0786
Copyright	Copyright (C) 2013 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.