CVE-2009-1213: Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 3.2 before 3.2.3, 3.3 before...

Security readout for executives and security teams

This vulnerability affects old Bugzilla installations. A malicious site could make an already signed-in Bugzilla user submit an attachment-editing request they did not intend. The business risk depends on who can edit attachments and what those attachments support, such as issue evidence, patches, or internal workflow records. Exposure is likely limited to organizations still running affected Bugzilla versions or legacy packaged builds. Internet-facing or broadly accessible Bugzilla instances have higher practical risk, especially where privileged users regularly edit attachments. Current, vendor-maintained Bugzilla deployments are less likely to be exposed. Treat this as a legacy-platform remediation item. It is not marked as actively exploited in the supplied evidence, but affected Bugzilla instances can allow unauthorized changes through trusted users. Prioritize if Bugzilla is internet-facing, supports security-sensitive workflows, or is still on unsupported versions. Mitigation focus: Upgrade Bugzilla 3.2 deployments to 3.2.3 or later.; Upgrade Bugzilla 3.3 deployments to 3.3.4 or later.; For earlier versions, follow Bugzilla and distribution vendor guidance..

Prepared

Jun 28, 2026, 11:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.