CVE-2009-0486

Bugzilla 3.2.1, 3.0.7, and 3.3.2, when running under mod_perl, calls the srand function at startup time, which causes Apache children to have the same seed and…

published February 9, 2009

CVSS
—
EPSS
1%
Percentile
46.2
In the wild
Unconfirmed
What it is

Bugzilla 3.2.1, 3.0.7, and 3.3.2, when running under mod_perl, calls the srand function at startup time, which causes Apache children to have the same seed and produce insufficiently random numbers for random tokens, which allows remote attackers to bypass cross-site request forgery (CSRF) protection mechanisms and conduct unauthorized activities as other users.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00571 · 46.2th percentile
Published
2009-02-09T17:00Z
EPSS history
Timeline
  • 09 FEB 17:00Z
    Bugzilla 3.2.1, 3.0.7, and 3.3.2, when running under mod_perl, calls the srand function at startup time, which causes Apache children to have the same seed and…
    cvelistv5