CVE-2013-1734: Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 2.x, 3.x, and 4.0.x before 4....

Security readout for executives and security teams

This vulnerability affects older Bugzilla installations and could let an attacker trick a logged-in user into making unintended attachment changes. The business risk depends on whether the organization still runs an affected Bugzilla version and who can access it. Exposure is most likely in legacy self-hosted Bugzilla deployments, especially instances reachable by users through a browser. Current exposure cannot be inferred from the bundle without an asset inventory. Treat this as a legacy-platform hygiene issue with moderate urgency. It is not cited as actively exploited here, but old Bugzilla systems can carry accumulated risk and should be upgraded or retired. Mitigation focus: Upgrade affected Bugzilla branches to the fixed versions named in the advisory.; Move unsupported Bugzilla 2.x or 3.x deployments to a supported fixed release.; Review the Bugzilla security advisory for any branch-specific guidance..

Prepared

Jun 14, 2026, 15:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.