CVE-2009-0483: Cross-site request forgery (CSRF) vulnerability in Bugzilla 2.22 before 2.22.7, 3.0 before 3.0.7, 3.2 befor...

Security readout for executives and security teams

This issue lets an attacker trick a logged-in Bugzilla user into unintentionally deleting keywords or user preferences by loading a malicious link or image. It is an integrity and administration risk, not evidence of direct server takeover in the supplied sources. Exposure is likely limited to organizations still running the listed legacy Bugzilla branches or downstream packages that had not received the 2009 fixes. Public internet exposure increases opportunity, especially for users with keyword administration rights. Treat this as a cleanup and legacy exposure issue unless vulnerable Bugzilla remains in production. Prioritize internet-facing or administrator-used systems first, because the impact is unauthorized configuration change through authenticated users rather than unauthenticated compromise. Mitigation focus: Upgrade Bugzilla to 2.22.7, 3.0.7, 3.2.1, 3.3.2, or later supported versions.; Apply relevant Fedora or vendor Bugzilla security packages where Bugzilla is OS-managed.; Check current Bugzilla vendor guidance for any branch-specific remediation details..

Prepared

Jun 28, 2026, 11:23 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.