PT-2004-2540 · Mozilla · Bugzilla

Publicado 2004-10-25 · Atualizado 2017-07-11 · CVE-2004-1634

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.17.1 through 2.18rc2 Bugzilla version 2.19 from CVS

Description The issue allows remote attackers to gain sensitive information by showing private comments and attachment summaries when exporting a bug to XML, using the insidergroup feature.

Recommendations For Bugzilla versions 2.17.1 through 2.18rc2, consider disabling the insidergroup feature until a patch is available. For Bugzilla version 2.19 from CVS, restrict access to the show bug.cgi module to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2004-1634

Produtos afetados

Bugzilla

Referências · 6

• https://exchange.xforce.ibmcloud.com/vulnerabilities/17841 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1634 · Nota
• http://marc.info/?l=bugtraq&m=109872095201238&w=2 · Nota
• https://bugzilla.mozilla.org/show_bug.cgi?id=263780 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-1634 · Nota de Segurança
• http://securityfocus.com/bid/11511 · Aviso do Fabricante