Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2009-0486: Bugzilla permits CSRF bypass when run under mod_perl
CVE-2009-0486 · published 17 years ago
Summary
Bugzilla versions 3.0.7, 3.2.1 and 3.3.2 can generate predictable security tokens when they are started under Apache's mod_perl. This makes the built‑in cross‑site request forgery protection ineffective, letting an attacker act as another user. Update to a newer Bugzilla release or run it without mod_perl to restore proper randomness.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| mozilla | bugzilla |
3.0.7 3.2.1 3.3.2 cpe:2.3:a:mozilla:bugzilla:3.0.7:*:*:*:*:*:*:* |
Original advisory text
Bugzilla 3.2.1, 3.0.7, and 3.3.2, when running under mod_perl, calls the srand function at startup time, which causes Apache children to have the same seed and produce insufficiently random numbers...
Bugzilla 3.2.1, 3.0.7, and 3.3.2, when running under mod_perl, calls the srand function at startup time, which causes Apache children to have the same seed and produce insufficiently random numbers for random tokens, which allows remote attackers to bypass cross-site request forgery (CSRF) protection mechanisms and conduct unauthorized activities as other users.
References
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Severity
7.5
High
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published9 Feb 2009
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2009-0486 · NVD
Track software like this
Free during beta