CVE-2014-1546

CVE-2014-1546 describes a cross-site request forgery (CSRF) and information disclosure vulnerability in Bugzilla versions 3.x, 4.x, 4.1.x, 4.2.x, 4.3.x, 4.4.x, and 4.5.x prior to specific patch levels. The flaw exists in the JSONP endpoint's response function, which improperly handles long callback values and initial JSONP response bytes. This allows remote attackers to craft a malicious OBJECT element with SWF content to conduct CSRF attacks and potentially obtain sensitive information. The vulnerability has a CVSS score of 4.3 (Medium), indicating a network-based attack with medium complexity, requiring no authentication, and primarily impacting confidentiality. There is no known active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness and attention.