CVE-2012-0440: Cross-site request forgery (CSRF) vulnerability in jsonrpc.cgi in Bugzilla 3.5.x and 3.6.x before 3.6.8, 3....

Security readout for executives and security teams

Older Bugzilla releases had a CSRF flaw in the JSON-RPC endpoint. If an authenticated user was tricked into visiting a malicious page, an attacker could cause that user's browser to send unwanted Bugzilla API requests. The business risk is unauthorized issue-tracker actions under a legitimate account, mainly where obsolete Bugzilla versions remain exposed. Exposure is likely limited to organizations still running the listed legacy Bugzilla branches, especially internet-accessible or broadly reachable Bugzilla deployments with active authenticated users. Treat as medium priority unless legacy Bugzilla remains exposed. If affected versions are still in production, schedule remediation promptly because issue trackers can contain sensitive engineering and security information. Mitigation focus: Identify all Bugzilla instances and their exact versions.; Upgrade affected Bugzilla branches to fixed versions or later.; Use the Bugzilla advisory for branch-specific upgrade guidance..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.