CVE-2004-1061: Cross-site scripting (XSS) vulnerability in Bugzilla before 2.18, including 2.16.x before 2.16.11, allows r...

Security readout for executives and security teams

CVE-2004-1061 is an old Bugzilla cross-site scripting issue. A remote attacker could make vulnerable Bugzilla pages render attacker-supplied HTML or script through forced error messages. Business risk is highest where legacy Bugzilla is still reachable and trusted by staff handling sensitive bug or security data. Exposure is likely limited to organizations still running unsupported Bugzilla versions before 2.18 or 2.16.11. Internet-facing or partner-accessible trackers increase risk. Modern Bugzilla deployments are unlikely to be affected if they are on maintained releases. Treat as a targeted legacy-risk cleanup item, not an emergency based on the supplied evidence. Prioritize quickly if any vulnerable Bugzilla system is internet-facing or stores security defects, credentials, customer data, or embargoed vulnerability information. Mitigation focus: Identify all Bugzilla instances and confirm their exact version.; Upgrade vulnerable installations to 2.18, 2.16.11, or later supported releases.; If upgrade is delayed, restrict access to trusted users and networks..

Prepared

Jun 30, 2026, 01:38 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.