PT-2005-3963 · Mozilla · Bugzilla

Frédéric Buclin · Published 2005-10-05 · Updated 2017-07-11 · CVE-2005-3139

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.19.1 through 2.20rc2 Bugzilla version 2.21

Description The issue allows attackers to list all users whose names match an arbitrary substring when user matching is turned on in substring mode, even if the usevisibilitygroups parameter is set. This occurs because the substring mode does not properly respect the usevisibilitygroups parameter, leading to unauthorized user enumeration.

Recommendations For Bugzilla versions 2.19.1 through 2.20rc2, consider disabling the user matching feature in substring mode until a fix is available. For Bugzilla version 2.21, consider disabling the user matching feature in substring mode until a fix is available. As a temporary workaround, consider setting the usevisibilitygroups parameter to restrict user visibility, although this may not fully mitigate the issue.

Fix

Related Identifiers

CVE-2005-3139

Affected Products

Bugzilla

References · 7

• http://secunia.com/advisories/17030 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3139 · Security Note
• http://securityfocus.com/bid/14996 · Patch
• http://bugzilla.org/security/2.18.4 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=112818466125484&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42799 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3139 · Note