CVE-2011-0046
Multiple cross-site request forgery (CSRF) vulnerabilities in Bugzilla before 3.2.10, 3.4.x...
CVE-2011-0046 is a medium vulnerability (CVSS 6.8) in Mozilla Bugzilla, published January 28, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.14%, the 67th percentile. No source names a fixed version.
- Severity
- 6.8 MediumCVSS 2.0, NVD
- Exploit chance
- 1.14%EPSS, 67th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allow remote attackers to hijack the authentication of arbitrary users for requests related to (1) adding a saved search in buglist.cgi, (2) voting in votes.cgi, (3) sanity checking in sanitycheck.cgi, (4) creating or editing a chart in chart.cgi, (5) column changing in colchange.cgi, and (6) adding, deleting, or approving a quip in quips.cgi.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bugzillaDebian:6.0 From an advisory covering 10 CVEs | before 3.6.2.0-4.4, plus listed versions 3.6.2.0-4.2 | 3.6.2.0-4.4 |
What each source reports
NVD Score used
Multiple cross-site request forgery (CSRF) vulnerabilities in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allow remote attackers to hijack the authentication of arbitrary users for requests related to (1) adding a saved search in buglist.cgi, (2) voting in votes.cgi, (3) sanity checking in sanitycheck.cgi, (4) creating or editing a chart in chart.cgi, (5) column changing in colchange.cgi, and (6) adding, deleting, or approving a quip in quips.cgi.
- Record
CVE-2011-0046- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE ListNo score
Multiple cross-site request forgery (CSRF) vulnerabilities in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allow remote attackers to hijack the authentication of arbitrary users for requests related to (1) adding a saved search in buglist.cgi, (2) voting in votes.cgi, (3) sanity checking in sanitycheck.cgi, (4) creating or editing a chart in chart.cgi, (5) column changing in colchange.cgi, and (6) adding, deleting, or approving a quip in quips.cgi.
- Record
CVE-2011-0046- Updated
- 2026-11-02
EUVDEUVD-2011-0072No score
Multiple cross-site request forgery (CSRF) vulnerabilities in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allow remote attackers to hijack the authentication of arbitrary users for requests related to (1) adding a saved search in buglist.cgi, (2) voting in votes.cgi, (3) sanity checking in sanitycheck.cgi, (4) creating or editing a chart in chart.cgi, (5) column changing in colchange.cgi, and (6) adding, deleting, or approving a quip in quips.cgi.
- Record
EUVD-2011-0072- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vxhq-w38v-xx5fNo score
Multiple cross-site request forgery (CSRF) vulnerabilities in Bugzilla before 3.2.10, 3.4.x...
Multiple cross-site request forgery (CSRF) vulnerabilities in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allow remote attackers to hijack the authentication of arbitrary users for requests related to (1) adding a saved search in buglist.cgi, (2) voting in votes.cgi, (3) sanity checking in sanitycheck.cgi, (4) creating or editing a chart in chart.cgi, (5) column changing in colchange.cgi, and (6) adding, deleting, or approving a quip in quips.cgi.
- Record
GHSA-vxhq-w38v-xx5f- Weakness
- CWE-352
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
bugzilla.mozilla.org/show_bug.cgi?id=621105
osvdb.org/70710
securityfocus.com/bid/45982
secunia.com/advisories/43165
Show 18 moreShow less
bugzilla.org/security/3.2.9
lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html
vupen.com/english/advisories/2011/0271
exchange.xforce.ibmcloud.com/vulnerabilities/65003
debian.org/security/2011/dsa-2322
nvd.nist.gov/vuln/detail/CVE-2011-0046
github.com/advisories/GHSA-vxhq-w38v-xx5f