CVE-2015-8509
LOW 3.5EPSS 1.9%
Template.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.16, 4.3.x and 4.4.x before 4.4.11, and 4.5.x and 5.0.x before 5.0.2 does not properly construct CSV files, which allows remote attackers to obtain sensitive information by leveraging a web browser that interprets CSV data as JavaScript code.
- CVSS v3.0 NVD
- 3.5 LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - CVSS v2.0 NVD
- 4.3 MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N - EPSS
- 1.91% chance of exploitation in the next 30 days, 79th percentile
- Published
- 2016-01-03
- Updated
- 2024-08-06