CVE-2010-4567: Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 does not properly...

Security readout for executives and security teams

This is a stored cross-site scripting issue in older Bugzilla versions. A crafted URL field could make Bugzilla treat a dangerous link as acceptable when whitespace appears before the URI scheme. If a user views or follows that field, attacker-controlled script could run in the Bugzilla user’s browser context. Exposure is most likely in legacy self-hosted Bugzilla deployments, especially systems still running the affected upstream or distribution package versions. Internet-facing trackers have higher business risk, but internal trackers can still expose authenticated users and sensitive project data. Treat as a legacy web application risk requiring timely cleanup. It is not marked as known exploited in the provided sources, but XSS in an issue tracker can affect privileged staff sessions and sensitive project data. Mitigation focus: Upgrade Bugzilla to 3.2.10, 3.4.10, 3.6.4, 4.0rc2, or later supported releases.; Apply relevant vendor distribution updates, including Debian or Fedora packages where applicable.; Review Bugzilla’s security advisory and vendor guidance for any environment-specific instructions..

Prepared

Jun 27, 2026, 18:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.