CVE-2014-1546: The response function in the JSONP endpoint in WebService/Server/JSONRPC.pm in jsonrpc.cgi in Bugzilla 3.x...

Security readout for executives and security teams

A flaw in Bugzilla’s JSONP interface could let an attacker abuse a victim’s browser to make unauthorized requests and expose sensitive Bugzilla information. It affects older Bugzilla 3.x and 4.x releases before the fixed versions named in advisories. The source bundle does not provide a CVSS score or evidence of active exploitation. Exposure is most likely where legacy Bugzilla 3.x or 4.x instances remain reachable by users through jsonrpc.cgi, especially internet-facing or partner-accessible trackers containing private bugs, user data, or security-sensitive issue details. Treat this as a targeted remediation item for any remaining legacy Bugzilla deployment. It is not KEV-listed in the bundle, but exposed issue trackers can contain sensitive operational and security information, making delayed patching a governance risk. Mitigation focus: Upgrade affected Bugzilla branches to the fixed versions or later.; Check current vendor or distribution advisories for supported package updates.; Restrict external access to legacy Bugzilla until upgraded..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.