VYPR
← All advisories
Unrated severityNVD Advisory· Published Feb 9, 2009· Updated Apr 23, 2026

CVE-2009-0481

CVE-2009-0481

Description

Bugzilla 2.x before 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote authenticated users to conduct cross-site scripting (XSS) and related attacks by uploading HTML and JavaScript attachments that are rendered by web browsers.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Authenticated users can upload malicious HTML/JS attachments in Bugzilla, leading to cross-site scripting when other users view them.

Vulnerability

Bugzilla versions 2.x before 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allow authenticated users to upload HTML or JavaScript attachments. When other users view these attachments in their browsers, the attachments render in the context of the Bugzilla domain, enabling cross-site scripting (XSS) attacks [1].

Exploitation

An attacker with a valid Bugzilla account can upload a specially crafted HTML or JavaScript attachment. The attacker then tricks a victim into viewing the attachment, for example by sending a direct link. When the victim's browser renders the attachment, it executes in the Bugzilla domain context, bypassing cross-site request protections [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser within the Bugzilla domain. This can lead to cookie theft, session hijacking, and unauthorized actions such as modifying bug data, changing user preferences, or deleting keywords and saved searches [1].

Mitigation

Bugzilla has released fixed versions 2.22.7, 3.0.7, 3.2.1, and 3.3.2. The fix introduces a new configuration parameter allow_attachment_display that defaults to off, preventing inline viewing of attachments. Administrators should upgrade to the latest versions. If upgrade is not immediately possible, consider blocking direct access to attachment URLs or disabling attachment viewing via web server configuration [1].

References
  1. 3.2, 3.0.6, 2.22.6, and 3.3.1 Security Advisory

AI Insight generated on May 24, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

77
  • Mozilla Corporation/Bugzilla76 versions
    cpe:2.3:a:mozilla:bugzilla:2.10:*:*:*:*:*:*:*+ 75 more
    • cpe:2.3:a:mozilla:bugzilla:2.10:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.12:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.14:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.14.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.14.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.14.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.14.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.14.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.16:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.16.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.16.10:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.16.11:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.16.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.16.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.16.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.16.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.16.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.16.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.16.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.16.9:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.16:rc1:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.16_rc2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.17:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.17.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.17.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.17.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.17.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.17.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.17.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.17.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.18:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.18.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.18.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.18.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.18.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.18.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.18.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.18.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.18.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.18.9:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.18:rc1:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.18:rc2:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.18:rc3:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.19:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.19.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.19.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.19.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.20:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.20.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.20.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.20.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.20.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.20.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.20.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.20:rc1:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.20:rc2:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.21:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.21.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.21.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.22:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.22.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.22.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.22.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.22.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.22.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.22.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:2.22:rc1:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:3.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:3.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:3.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:3.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:3.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:3.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:3.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:3.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:bugzilla:3.3.1:*:*:*:*:*:*:*
  • Python Bugzilla Project/Python Bugzillallm-fuzzy
    Range: <2.22.7, <3.0.7, <3.2.1, <3.3.2

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

0

No linked articles in our index yet.