Skip to content

CVE-2011-0048

Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 creates...

4.3 MediumFix available

CVE-2011-0048 is a medium vulnerability (CVSS 4.3) in Mozilla Bugzilla, published January 28, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.79%, the 78th percentile. Fixed in bugzilla 3.6.2.0-4.4.

Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 creates a clickable link for a (1) javascript: or (2) data: URI in the URL (aka bug_file_loc) field, which allows remote attackers to conduct cross-site scripting (XSS) attacks against logged-out users via a crafted URI.

Exploit likelihood

1.79%Down 0.2 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 creates a clickable link for a (1) javascript: or (2) data: URI in the URL (aka bug_file_loc) field, which allows remote attackers to conduct cross-site scripting (XSS) attacks against logged-out users via a crafted URI.

Record: CVE-2011-0048
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 creates a clickable link for a (1) javascript: or (2) data: URI in the URL (aka bug_file_loc) field, which allows remote attackers to conduct cross-site scripting (XSS) attacks against logged-out users via a crafted URI.

Record: CVE-2011-0048
Updated: 2026-11-02

EUVDEUVD-2011-0074 No score

Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 creates a clickable link for a (1) javascript: or (2) data: URI in the URL (aka bug_file_loc) field, which allows remote attackers to conduct cross-site scripting (XSS) attacks against logged-out users via a crafted URI.

Record: EUVD-2011-0074
Updated: 2026-11-03

GitHub AdvisoriesGHSA-878r-3rvr-3qg8 No score

Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 creates...

Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 creates a clickable link for a (1) javascript: or (2) data: URI in the URL (aka bug_file_loc) field, which allows remote attackers to conduct cross-site scripting (XSS) attacks against logged-out users via a crafted URI.

Record: GHSA-878r-3rvr-3qg8
Weakness: CWE-79
Updated: 2026-11-02

Affected products

mozilla bugzilla

Affected packages

Affected packages
Package	Affected	Fixed
`bugzilla` Debian:6.0	before 3.6.2.0-4.4, plus listed versions 3.6.2.0-4.2	3.6.2.0-4.4

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 8 moreShow less