PT-2004-2540 · Mozilla · Bugzilla

Published 2004-10-25 · Updated 2017-07-11 · CVE-2004-1634

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.17.1 through 2.18rc2 Bugzilla version 2.19 from CVS

Description The issue allows remote attackers to gain sensitive information by showing private comments and attachment summaries when exporting a bug to XML, using the insidergroup feature.

Recommendations For Bugzilla versions 2.17.1 through 2.18rc2, consider disabling the insidergroup feature until a patch is available. For Bugzilla version 2.19 from CVS, restrict access to the show bug.cgi module to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2004-1634

Affected Products

Bugzilla

References · 6

• https://bugzilla.mozilla.org/show_bug.cgi?id=263780 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-1634 · Security Note
• http://securityfocus.com/bid/11511 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17841 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1634 · Note
• http://marc.info/?l=bugtraq&m=109872095201238&w=2 · Note