CVE-2009-1213

Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 3.2 before 3.2.3, 3.3 before 3.3.4, and earlier versions allows remote attackers to hijack the authentication of arbitrary users for requests that use attachment editing.

• CWE-352

• http://secunia.com/advisories/34545Vendor Advisory
• http://secunia.com/advisories/34547Vendor Advisory
• http://secunia.com/advisories/34624
• http://www.bugzilla.org/security/3.2.2/Patch, Vendor Advisory
• http://www.securityfocus.com/bid/34308
• http://www.vupen.com/english/advisories/2009/0887Patch, Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=476603Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49524
• https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00188.html
• https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00191.html
• http://secunia.com/advisories/34545Vendor Advisory
• http://secunia.com/advisories/34547Vendor Advisory
• http://secunia.com/advisories/34624
• http://www.bugzilla.org/security/3.2.2/Patch, Vendor Advisory
• http://www.securityfocus.com/bid/34308
• http://www.vupen.com/english/advisories/2009/0887Patch, Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=476603Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49524
• https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00188.html
• https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00191.html

Published

Apr 1, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-1207Race condition in the dircmp script in Sun Solaris 8 through…
• CVE-2009-1208SQL injection vulnerability in auth2db 0.2.5, and possibly o…
• CVE-2009-1209Stack-based buffer overflow in W3C Amaya Web Browser 11.1 al…
• CVE-2009-1210Format string vulnerability in the PROFINET/DCP (PN-DCP) dis…
• CVE-2009-1211Blue Coat ProxySG, when transparent interception mode is ena…
• CVE-2009-1212Multiple insecure method vulnerabilities in PRECIS~2.DLL in …
• CVE-2009-1214GNU screen 4.0.3 creates the /tmp/screen-exchange temporary …
• CVE-2009-1215Race condition in GNU screen 4.0.3 allows local users to cre…
• CVE-2009-1216Multiple unspecified vulnerabilities in (1) unlzh.c and (2) …
• CVE-2009-1217Off-by-one error in the GpFont::SetData function in gdiplus.…
• CVE-2009-1218Multiple cross-site scripting (XSS) vulnerabilities in Sun C…
• CVE-2009-1219Sun Calendar Express Web Server in Sun ONE Calendar Server 6…