CVE-2011-3668: Cross-site request forgery (CSRF) vulnerability in post_bug.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2rc1...

Security readout for executives and security teams

This flaw let an attacker trick a logged-in Bugzilla user into submitting a new bug report without intending to. The business impact is mainly workflow integrity: false reports, misleading attribution, and potential abuse of trusted accounts. The sources do not show code execution, data theft, or confirmed active exploitation. Exposure is limited to organizations still running affected Bugzilla versions, especially instances reachable by users through a browser. Internet-facing or broadly accessible internal trackers have higher practical risk than tightly restricted deployments. Treat this as a moderate-priority legacy application risk. It is not reported as actively exploited, but unpatched Bugzilla systems can have trusted users coerced into creating false records, affecting operational trust and audit quality. Mitigation focus: Upgrade Bugzilla to 4.2rc1 or later, or a vendor-supported fixed release.; Review the Bugzilla security advisory for branch-specific upgrade guidance.; Restrict access to legacy Bugzilla instances until patched..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.