CVE-2010-4568
Bugzilla 2.14 through 2.22.7; 3.0.x, 3.1.x, and 3.2.x before 3.2.10; 3.4.x before 3.4.10; 3.6.x...
CVE-2010-4568 is a high vulnerability (CVSS 7.5) in Mozilla Bugzilla, published January 28, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.53%, the 84th percentile. Fixed in bugzilla 3.6.2.0-4.4.
Bugzilla 2.14 through 2.22.7; 3.0.x, 3.1.x, and 3.2.x before 3.2.10; 3.4.x before 3.4.10; 3.6.x before 3.6.4; and 4.0.x before 4.0rc2 does not properly generate random values for cookies and tokens, which allows remote attackers to obtain access to arbitrary accounts via unspecified vectors, related to an insufficient number of calls to the srand function.
Exploit likelihood
What each source reports
NVD Score used
Bugzilla 2.14 through 2.22.7; 3.0.x, 3.1.x, and 3.2.x before 3.2.10; 3.4.x before 3.4.10; 3.6.x before 3.6.4; and 4.0.x before 4.0rc2 does not properly generate random values for cookies and tokens, which allows remote attackers to obtain access to arbitrary accounts via unspecified vectors, related to an insufficient number of calls to the srand function.
- Record
CVE-2010-4568- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Bugzilla 2.14 through 2.22.7; 3.0.x, 3.1.x, and 3.2.x before 3.2.10; 3.4.x before 3.4.10; 3.6.x before 3.6.4; and 4.0.x before 4.0rc2 does not properly generate random values for cookies and tokens, which allows remote attackers to obtain access to arbitrary accounts via unspecified vectors, related to an insufficient number of calls to the srand function.
- Record
CVE-2010-4568- Updated
- 2026-11-02
EUVDEUVD-2010-4534 No score
Bugzilla 2.14 through 2.22.7; 3.0.x, 3.1.x, and 3.2.x before 3.2.10; 3.4.x before 3.4.10; 3.6.x before 3.6.4; and 4.0.x before 4.0rc2 does not properly generate random values for cookies and tokens, which allows remote attackers to obtain access to arbitrary accounts via unspecified vectors, related to an insufficient number of calls to the srand function.
- Record
EUVD-2010-4534- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qrp2-qxjh-p3w7 No score
Bugzilla 2.14 through 2.22.7; 3.0.x, 3.1.x, and 3.2.x before 3.2.10; 3.4.x before 3.4.10; 3.6.x...
Bugzilla 2.14 through 2.22.7; 3.0.x, 3.1.x, and 3.2.x before 3.2.10; 3.4.x before 3.4.10; 3.6.x before 3.6.4; and 4.0.x before 4.0rc2 does not properly generate random values for cookies and tokens, which allows remote attackers to obtain access to arbitrary accounts via unspecified vectors, related to an insufficient number of calls to the srand function.
- Record
GHSA-qrp2-qxjh-p3w7- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bugzillaDebian:6.0 |
before 3.6.2.0-4.4, plus listed versions 3.6.2.0-4.2 |
3.6.2.0-4.4 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
securityfocus.com/bid/45982
secunia.com/advisories/43165
osvdb.org/70700
bugzilla.org/security/3.2.9
lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html
vupen.com/english/advisories/2011/0271
Show 10 moreShow less
bugzilla.mozilla.org/attachment.cgi?id=506031&action=diff
debian.org/security/2011/dsa-2322
exchange.xforce.ibmcloud.com/vulnerabilities/65001
nvd.nist.gov/vuln/detail/CVE-2010-4568
github.com/advisories/GHSA-qrp2-qxjh-p3w7