CVE-2014-1573
Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4...
CVE-2014-1573 is a medium vulnerability (CVSS 4.3) in Mozilla Bugzilla, published October 9, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.33%, the 83rd percentile. No source names a fixed version.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 2.33%EPSS, 83rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not ensure that a scalar context is used for certain CGI parameters, which allows remote attackers to conduct cross-site scripting (XSS) attacks by sending three values for a single parameter name.
Exploit likelihood
Affected products
Affected packages
What each source reports
NVD Score used
Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not ensure that a scalar context is used for certain CGI parameters, which allows remote attackers to conduct cross-site scripting (XSS) attacks by sending three values for a single parameter name.
- Record
CVE-2014-1573- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not ensure that a scalar context is used for certain CGI parameters, which allows remote attackers to conduct cross-site scripting (XSS) attacks by sending three values for a single parameter name.
- Record
CVE-2014-1573- Updated
- 2026-11-02
EUVDEUVD-2014-1649No score
Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not ensure that a scalar context is used for certain CGI parameters, which allows remote attackers to conduct cross-site scripting (XSS) attacks by sending three values for a single parameter name.
- Record
EUVD-2014-1649- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gw6m-j3wf-x49fNo score
Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4...
Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not ensure that a scalar context is used for certain CGI parameters, which allows remote attackers to conduct cross-site scripting (XSS) attacks by sending three values for a single parameter name.
- Record
GHSA-gw6m-j3wf-x49f- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVMGASA-2014-0412No score
Updated bugzilla packages fix security vulnerabilities
Updated bugzilla packages fix security vulnerabilities:
If a new comment was marked private to the insider group, and a flag was set in the same transaction, the comment would be visible to flag recipients even if they were not in the insider group (CVE-2014-1571).
An attacker creating a new Bugzilla account can override certain parameters when finalizing the account creation that can lead to the user being created with a different email address than originally requested. The overridden login name could be automatically added to groups based on the group's regular expression setting (CVE-2014-1572).
During an audit of the Bugzilla code base, several places were found where cross-site scripting exploits could occur which could allow an attacker to access sensitive information (CVE-2014-1573).
- Record
MGASA-2014-0412- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
opennet.ru/opennews/art.shtml?num=40766
mandriva.com/security/advisories?name=MDVSA-2014:200
packetstormsecurity.com/files/128578/Bugzilla-Account-Creation-XSS-Information-Leak.html
securityfocus.com/bid/70257
openwall.com/lists/oss-security/2014/10/07/20
lists.fedoraproject.org/pipermail/package-announce/2014-November/142524.html
Show 13 moreShow less
reddit.com/r/netsec/comments/2ihen0/new_class_of_vulnerability_in_perl_web
blog.gerv.net/2014/10/new-class-of-vulnerability-in-perl-web-applications
advisories.mageia.org/MGASA-2014-0412.html
bugzilla.org/security/4.0.14
security.gentoo.org/glsa/201607-11
securitytracker.com/id/1030978
bugzilla.mozilla.org/show_bug.cgi?id=1075578
nvd.nist.gov/vuln/detail/CVE-2014-1573
github.com/advisories/GHSA-gw6m-j3wf-x49f
bugs.mageia.org/show_bug.cgi?id=14241