CVE-2008-6098

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-02-09 · updated 2026-06-16
Weakness: CWE-264

Description

Bugzilla 3.2 before 3.2 RC2, 3.0 before 3.0.6, 2.22 before 2.22.6, 2.20 before 2.20.7, and other versions after 2.17.4 allows remote authenticated users to bypass moderation to approve and disapprove quips via a direct request to quips.cgi with the action parameter set to "approve."

Affected products

Mozilla Bugzilla: 2.17.4, 2.17.5, 2.17.6, 2.17.7, 2.18, 2.18-rc1 (+58)

References

http://secunia.com/advisories/32501
http://secunia.com/advisories/34361
http://www.bugzilla.org/security/2.20.6/
http://www.securityfocus.com/bid/32178
https://bugzilla.mozilla.org/show_bug.cgi?id=449931
https://exchange.xforce.ibmcloud.com/vulnerabilities/46424
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00664.html
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00687.html
http://secunia.com/advisories/32501
http://secunia.com/advisories/34361
http://www.bugzilla.org/security/2.20.6/
http://www.securityfocus.com/bid/32178

Get alerted when CVE-2008-6098 or the next vulnerability affects your stack