PT-2005-2544 · Mozilla · Bugzilla

Roman + 1 · Published 2005-05-12 · Updated 2016-10-18 · CVE-2005-1565

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.17.1 through 2.18 Bugzilla version 2.19.1 Bugzilla version 2.19.2

Description The issue allows local users to potentially gain sensitive information from web logs or browser history when a user is prompted to log in while attempting to view a chart, as the password is displayed in the URL.

Recommendations For Bugzilla versions 2.17.1 through 2.18, consider restricting access to web logs and browser history to minimize the risk of exploitation. For Bugzilla version 2.19.1, avoid using the password parameter in the affected login functionality until the issue is resolved. For Bugzilla version 2.19.2, as a temporary workaround, consider disabling the chart viewing feature for unauthenticated users until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2005-1565

Affected Products

Bugzilla

References · 9

• 🔥 http://secunia.com/advisories/15338 · Exploit
• 🔥 http://osvdb.org/16427 · Exploit
• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=287436 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-1565 · Security Note
• http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=001040 · Vendor Advisory
• http://securityfocus.com/bid/13605 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1565 · Note
• http://marc.info/?l=bugtraq&m=111592031902962&w=2 · Note
• http://vupen.com/english/advisories/2005/0533 · Note