Back
CVE-2006-2420
Bugzilla 2.20rc1 through 2.20 and 2.21.1, when using RSS 1.0, allows remote attackers to conduct cross-site scripting (XSS) attacks via a…
Medium4.3EPSS 1.6%
- Published
- Updated
- Reserved
- Assigned by
- mitre
Description
Bugzilla 2.20rc1 through 2.20 and 2.21.1, when using RSS 1.0, allows remote attackers to conduct cross-site scripting (XSS) attacks via a title element with HTML encoded sequences such as ">", which are automatically decoded by some RSS readers. NOTE: this issue is not in Bugzilla itself, but rather due to design or documentation inconsistencies within RSS, or implementation vulnerabilities in RSS readers. While this issue normally would not be included in CVE, it is being identified since the Bugzilla developers have addressed it.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 2.0 | Medium4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
- EPSS (exploitation in 30 days)
- 1.6% · top 24% of all CVEs (6 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.
Weakness
Affected products
n/a
- affected n/a
References (6)
- 18979 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- bugzilla-rss-title-xss(24820) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
- 20051001 Security Advisory for Bugzilla 2.18.3, 2.20rc2, and 2.21 (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
- 23379 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
- http://www.bugzilla.org/security/2.18.4 (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://bugzilla.mozilla.org/show_bug.cgi?id=313441 (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2006-2420)Record last updated .