PT-2005-3963 · Mozilla · Bugzilla

Frédéric Buclin · Publicado 2005-10-05 · Atualizado 2017-07-11 · CVE-2005-3139

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.19.1 through 2.20rc2 Bugzilla version 2.21

Description The issue allows attackers to list all users whose names match an arbitrary substring when user matching is turned on in substring mode, even if the usevisibilitygroups parameter is set. This occurs because the substring mode does not properly respect the usevisibilitygroups parameter, leading to unauthorized user enumeration.

Recommendations For Bugzilla versions 2.19.1 through 2.20rc2, consider disabling the user matching feature in substring mode until a fix is available. For Bugzilla version 2.21, consider disabling the user matching feature in substring mode until a fix is available. As a temporary workaround, consider setting the usevisibilitygroups parameter to restrict user visibility, although this may not fully mitigate the issue.

Correção

Identificadores relacionados

CVE-2005-3139

Produtos afetados

Bugzilla

Referências · 7

• http://secunia.com/advisories/17030 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-3139 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=112818466125484&w=2 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42799 · Nota
• http://securityfocus.com/bid/14996 · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3139 · Nota
• http://bugzilla.org/security/2.18.4 · Aviso do Fabricante