CVE-2012-0440

Cross-site request forgery (CSRF) vulnerability in jsonrpc.cgi in Bugzilla 3.5.x and 3.6.x before 3.6.8, 3.7.x and 4.0.x before 4.0.4, and…

Medium5.1EPSS 0.60%

Published: 2 Feb 2012
Updated: 6 Aug 2024
Reserved: 9 Jan 2012
Assigned by: mitre

Description

Cross-site request forgery (CSRF) vulnerability in jsonrpc.cgi in Bugzilla 3.5.x and 3.6.x before 3.6.8, 3.7.x and 4.0.x before 4.0.4, and 4.1.x and 4.2.x before 4.2rc2 allows remote attackers to hijack the authentication of arbitrary users for requests that use the JSON-RPC API.

Timeline

2012
9 Jan 2012
9 Jan 2012
ID reserved
By mitre
2 Feb 201224 days later
2 Feb 2012· 24 days later
Published
2024
6 Aug 202413 years later
6 Aug 2024· 13 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2012-0440, by who scored it
Scored by	CVSS	Score	Vector
NVDNVD · Modified	2.0	Medium5.1	AV:N/AC:H/Au:N/C:P/I:P/A:P

EPSS (exploitation in 30 days): 0.60% · top 51% of all CVEs (8 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.1.

Weakness

Affected products

n/a
- affected n/a

References (5)

http://www.bugzilla.org/security/3.4.13/ (opens in a new tab)x_refsource_CONFIRMx_transferred
47814 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
1026623 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
https://bugzilla.mozilla.org/show_bug.cgi?id=718319 (opens in a new tab)x_refsource_CONFIRMx_transferred
bugzilla-jsonrpc-csrf(72882) (opens in a new tab)vdb-entryx_refsource_XFx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2012-0440](https://cveledger.app/badge/CVE-2012-0440.svg)](https://cveledger.app/cve/CVE-2012-0440)

Record last updated 6 Aug 2024, 18:23 UTC.