Bugzilla is prone to a cross-site request-forgery vulnerability. An attacker can exploit this issue to submit attachments in the context of the logged-in user. This issue affects versions prior to Bugzilla 3.2.3 and 3.3.4.

The vendor released updates to address this issue. Please see http://www.bugzilla.org/ for more information.

• http://www.securityfocus.com/bid/34308

---

Updated on 2015-03-25