FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2006-2420

This CVE name corresponds to:

Entered	Topic
2006-02-27	bugzilla -- multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2006-2420 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2006-2420
Phase	Assigned(20060515)

Description

Bugzilla 2.20rc1 through 2.20 and 2.21.1, when using RSS 1.0, allows remote attackers to conduct cross-site scripting (XSS) attacks via a title element with HTML encoded sequences such as ">", which are automatically decoded by some RSS readers. NOTE: this issue is not in Bugzilla itself, but rather due to design or documentation inconsistencies within RSS, or implementation vulnerabilities in RSS readers. While this issue normally would not be included in CVE, it is being identified since the Bugzilla developers have addressed it.

References

Source	Reference
BUGTRAQ	20051001 Security Advisory for Bugzilla 2.18.3, 2.20rc2, and 2.21
CONFIRM	http://www.bugzilla.org/security/2.18.4
CONFIRM	https://bugzilla.mozilla.org/show_bug.cgi?id=313441
OSVDB	23379
SECUNIA	18979
XF	bugzilla-rss-title-xss(24820)