CVE-2010-4570

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2011-01-28 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the duplicate-detection functionality in Bugzilla 3.7.1, 3.7.2, 3.7.3, and 4.0rc1 allows remote attackers to inject arbitrary web script or HTML via the summary field, related to the DataTable widget in YUI.

Affected products

Mozilla Bugzilla: 3.7.1, 3.7.2, 3.7.3, 4.0-rc1

References

http://osvdb.org/70702
http://www.bugzilla.org/security/3.2.9/
http://www.securityfocus.com/bid/45982
http://www.vupen.com/english/advisories/2011/0207
http://www.vupen.com/english/advisories/2011/0271
http://yuilibrary.com/forum/viewtopic.php?p=12923
http://yuilibrary.com/projects/yui2/ticket/2529228
https://bugzilla.mozilla.org/show_bug.cgi?id=619648
https://exchange.xforce.ibmcloud.com/vulnerabilities/65179
http://osvdb.org/70702
http://www.bugzilla.org/security/3.2.9/
http://www.securityfocus.com/bid/45982

Get alerted when CVE-2010-4570 or the next vulnerability affects your stack