CVE - CVE-2006-2420

CVE-ID
CVE-2006-2420	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Bugzilla 2.20rc1 through 2.20 and 2.21.1, when using RSS 1.0, allows remote attackers to conduct cross-site scripting (XSS) attacks via a title element with HTML encoded sequences such as ">", which are automatically decoded by some RSS readers. NOTE: this issue is not in Bugzilla itself, but rather due to design or documentation inconsistencies within RSS, or implementation vulnerabilities in RSS readers. While this issue normally would not be included in CVE, it is being identified since the Bugzilla developers have addressed it.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BUGTRAQ:20051001 Security Advisory for Bugzilla 2.18.3, 2.20rc2, and 2.21 URL:http://marc.info/?l=bugtraq&m=112818466125484&w=2 CONFIRM:http://www.bugzilla.org/security/2.18.4 CONFIRM:https://bugzilla.mozilla.org/show_bug.cgi?id=313441 OSVDB:23379 URL:~~http://www.osvdb.org/23379~~ (Obsolete source) SECUNIA:18979 URL:http://secunia.com/advisories/18979 XF:bugzilla-rss-title-xss(24820) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/24820
Assigning CNA
MITRE Corporation
Date Record Created
20060515	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20060515)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)