PT-2001-1555 · Mozilla · Bugzilla

Published 2001-06-27 · Updated 2017-10-10 · CVE-2001-0330

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bugzilla version 2.10

Description The issue allows remote attackers to access sensitive information, including the database username and password, via an HTTP request for the 'globals.pl' file. This file is normally returned by the web server without being executed, thus exposing the sensitive data.

Recommendations For Bugzilla version 2.10, consider restricting access to the 'globals.pl' file to prevent unauthorized disclosure of sensitive information. As a temporary workaround, ensure that the web server is configured to execute the 'globals.pl' file instead of returning it, or remove the file from publicly accessible directories until a proper fix is applied.

Fix

Related Identifiers

CVE-2001-0330

Affected Products

Bugzilla

References · 5

• http://securityfocus.com/bid/2671 · Vendor Advisory
• http://atstake.com/research/advisories/2001/a043001-1.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-0330 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6489 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0330 · Note