CVE-2009-0485: Cross-site request forgery (CSRF) vulnerability in Bugzilla 2.17 to 2.22.7, 3.0 before 3.0.7, 3.2 before 3....

Security readout for executives and security teams

This issue lets an attacker abuse a Bugzilla user's browser to delete unused flag types in affected Bugzilla versions. It is a configuration-impact CSRF flaw, not described as code execution or data theft. Business urgency depends on whether legacy Bugzilla is still used and whether privileged users can reach it from normal browsing sessions. Exposure is most likely in legacy Bugzilla deployments matching the listed versions. Internet-accessible or broadly reachable Bugzilla instances increase practical risk, especially where users with administrative or flag-management privileges browse while authenticated. Treat this as a legacy platform hygiene issue. It is not listed as known exploited in the provided sources, but affected Bugzilla systems can suffer unauthorized configuration changes if privileged users are tricked. Prioritize if Bugzilla is internet-facing or still operational. Mitigation focus: Inventory Bugzilla versions and identify any matching affected branches.; Upgrade affected Bugzilla deployments using Bugzilla or distribution vendor guidance.; Review Fedora advisories if using Fedora-packaged Bugzilla from that era..

Prepared

Jun 28, 2026, 11:23 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.