CVE-2006-2420

CVSS V2 Medium 4.3 CVSS V3 None

Description

Bugzilla 2.20rc1 through 2.20 and 2.21.1, when using RSS 1.0, allows remote attackers to conduct cross-site scripting (XSS) attacks via a title element with HTML encoded sequences such as ">", which are automatically decoded by some RSS readers. NOTE: this issue is not in Bugzilla itself, but rather due to design or documentation inconsistencies within RSS, or implementation vulnerabilities in RSS readers. While this issue normally would not be included in CVE, it is being identified since the Bugzilla developers have addressed it.

Overview

CVE ID
CVE-2006-2420

Assigner
cve@mitre.org

Vulnerability Status
Modified

Published Version
2006-05-16T10:02:00

Last Modified Date
2017-07-20T01:31:27

Weakness Enumerations

CWE	URL
CWE-79	http://cwe.mitre.org/data/definitions/79.html

CPE Configuration (Product)

CPE	Vulnerable	Operator
cpe:2.3:a:mozilla:bugzilla:2.20:::::::*	1	OR
cpe:2.3:a:mozilla:bugzilla:2.20:rc1::::::	1	OR
cpe:2.3:a:mozilla:bugzilla:2.20:rc2::::::	1	OR
cpe:2.3:a:mozilla:bugzilla:2.21:::::::*	1	OR
cpe:2.3:a:mozilla:bugzilla:2.21.1:::::::*	1	OR

CVSS Version 2

Version
2.0

Vector String
AV:N/AC:M/Au:N/C:N/I:P/A:N

Access Vector
NETWORK

Access Compatibility
MEDIUM

Authentication
NONE

Confidentiality Impact
NONE

Integrity Impact
PARTIAL

Availability Impact
NONE

Base Score
4.3

Severity
MEDIUM

Exploitability Score
8.6

Impact Score
2.9

References

Reference URL	Reference Tags
http://www.bugzilla.org/security/2.18.4	Patch Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=313441	Patch
http://www.osvdb.org/23379
http://secunia.com/advisories/18979	Patch Vendor Advisory
http://marc.info/?l=bugtraq&m=112818466125484&w=2
https://exchange.xforce.ibmcloud.com/vulnerabilities/24820

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2006-2420
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2420

History

Created	Old Value	New Value	Data Type	Notes
2022-05-10 09:21:18				Added to TrackCVE