CVE-2015-8509

moderate-risk

Published 2016-01-03

Template.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.16, 4.3.x and 4.4.x before 4.4.11, and 4.5.x and 5.0.x before 5.0.2 does not properly construct CSV files, which allows remote attackers to obtain sensitive information by leveraging a web browser that interprets CSV data as JavaScript code.

Do I need to act?

0.26% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 3.5/10 Low

NETWORK / LOW complexity

Affected Products (20)

Bugzilla

Affected Vendors

Mozilla

References (12)

http://packetstormsecurity.com/files/135048/Bugzilla-Cross-Site-Scripting-Inform...

http://seclists.org/bugtraq/2015/Dec/131

http://www.securityfocus.com/bid/79662

http://www.securitytracker.com/id/1034556

Exploit https://bugzilla.mozilla.org/show_bug.cgi?id=1232785

https://www.bugzilla.org/security/4.2.15/

http://packetstormsecurity.com/files/135048/Bugzilla-Cross-Site-Scripting-Inform...

http://seclists.org/bugtraq/2015/Dec/131

http://www.securityfocus.com/bid/79662

http://www.securitytracker.com/id/1034556

Exploit https://bugzilla.mozilla.org/show_bug.cgi?id=1232785

https://www.bugzilla.org/security/4.2.15/

/ 100

moderate-risk

Severity 16/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 32/34 · Critical