PT-2001-1555 · Mozilla · Bugzilla

Publicado 2001-06-27 · Atualizado 2017-10-10 · CVE-2001-0330

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bugzilla version 2.10

Description The issue allows remote attackers to access sensitive information, including the database username and password, via an HTTP request for the 'globals.pl' file. This file is normally returned by the web server without being executed, thus exposing the sensitive data.

Recommendations For Bugzilla version 2.10, consider restricting access to the 'globals.pl' file to prevent unauthorized disclosure of sensitive information. As a temporary workaround, ensure that the web server is configured to execute the 'globals.pl' file instead of returning it, or remove the file from publicly accessible directories until a proper fix is applied.

Correção

Identificadores relacionados

CVE-2001-0330

Produtos afetados

Bugzilla

Referências · 5

• http://securityfocus.com/bid/2671 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6489 · Nota
• http://atstake.com/research/advisories/2001/a043001-1.txt · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0330 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2001-0330 · Nota de Segurança