CVE-2010-4568
Bugzilla 2.14 through 2.22.7; 3.0.x, 3.1.x, and 3.2.x before 3.2.10; 3.4.x before 3.4.10; 3.6.x...
CVE-2010-4568 is a high vulnerability (CVSS 7.5) in Mozilla Bugzilla, published January 28, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.53%, the 85th percentile. No source names a fixed version.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 2.53%EPSS, 85th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Bugzilla 2.14 through 2.22.7; 3.0.x, 3.1.x, and 3.2.x before 3.2.10; 3.4.x before 3.4.10; 3.6.x before 3.6.4; and 4.0.x before 4.0rc2 does not properly generate random values for cookies and tokens, which allows remote attackers to obtain access to arbitrary accounts via unspecified vectors, related to an insufficient number of calls to the srand function.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bugzillaDebian:6.0 From an advisory covering 10 CVEs | before 3.6.2.0-4.4, plus listed versions 3.6.2.0-4.2 | 3.6.2.0-4.4 |
What each source reports
NVD Score used
Bugzilla 2.14 through 2.22.7; 3.0.x, 3.1.x, and 3.2.x before 3.2.10; 3.4.x before 3.4.10; 3.6.x before 3.6.4; and 4.0.x before 4.0rc2 does not properly generate random values for cookies and tokens, which allows remote attackers to obtain access to arbitrary accounts via unspecified vectors, related to an insufficient number of calls to the srand function.
- Record
CVE-2010-4568- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
Bugzilla 2.14 through 2.22.7; 3.0.x, 3.1.x, and 3.2.x before 3.2.10; 3.4.x before 3.4.10; 3.6.x before 3.6.4; and 4.0.x before 4.0rc2 does not properly generate random values for cookies and tokens, which allows remote attackers to obtain access to arbitrary accounts via unspecified vectors, related to an insufficient number of calls to the srand function.
- Record
CVE-2010-4568- Updated
- 2026-11-02
EUVDEUVD-2010-4534No score
Bugzilla 2.14 through 2.22.7; 3.0.x, 3.1.x, and 3.2.x before 3.2.10; 3.4.x before 3.4.10; 3.6.x before 3.6.4; and 4.0.x before 4.0rc2 does not properly generate random values for cookies and tokens, which allows remote attackers to obtain access to arbitrary accounts via unspecified vectors, related to an insufficient number of calls to the srand function.
- Record
EUVD-2010-4534- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qrp2-qxjh-p3w7No score
Bugzilla 2.14 through 2.22.7; 3.0.x, 3.1.x, and 3.2.x before 3.2.10; 3.4.x before 3.4.10; 3.6.x...
Bugzilla 2.14 through 2.22.7; 3.0.x, 3.1.x, and 3.2.x before 3.2.10; 3.4.x before 3.4.10; 3.6.x before 3.6.4; and 4.0.x before 4.0rc2 does not properly generate random values for cookies and tokens, which allows remote attackers to obtain access to arbitrary accounts via unspecified vectors, related to an insufficient number of calls to the srand function.
- Record
GHSA-qrp2-qxjh-p3w7- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
securityfocus.com/bid/45982
secunia.com/advisories/43165
osvdb.org/70700
bugzilla.org/security/3.2.9
lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html
vupen.com/english/advisories/2011/0271
Show 10 moreShow less
bugzilla.mozilla.org/attachment.cgi?id=506031&action=diff
debian.org/security/2011/dsa-2322
exchange.xforce.ibmcloud.com/vulnerabilities/65001
nvd.nist.gov/vuln/detail/CVE-2010-4568
github.com/advisories/GHSA-qrp2-qxjh-p3w7