PT-2013-2613 · Mozilla · Bugzilla

Published 2013-02-24 · Updated 2013-12-13 · CVE-2013-0786

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.x through 3.6.12 Bugzilla versions 3.7.x Bugzilla versions 4.0.x through 4.0.9

Description The issue allows remote attackers to discover private product names by using debug mode for a query. This is due to the Bugzilla::Search::build subselect function generating different error messages for invalid product queries depending on whether a product exists.

Recommendations For Bugzilla versions 2.x through 3.6.12, update to version 3.6.13 or later. For Bugzilla versions 3.7.x, update to a version that is not affected by this issue. For Bugzilla versions 4.0.x through 4.0.9, update to version 4.0.10 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2013-0786

Affected Products

Bugzilla

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2013-0786 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2013:066 · Vendor Advisory
• http://bugzilla.org/security/3.6.12 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=824399 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0786 · Note