BID:13605

Bugzilla Authentication Information Disclosure Vulnerability

Info

Bugzilla Authentication Information Disclosure Vulnerability

Bugtraq ID:	13605
Class:	Design Error
CVE:	CVE-2005-1565
Remote:	Yes
Local:	No
Published:	May 12 2005 12:00AM
Updated:	Jul 12 2009 02:56PM
Credit:	Discovered by Roman Pszonka <[email protected]>.
Vulnerable:	Mozilla Bugzilla 2.19.2 Mozilla Bugzilla 2.19.1 Mozilla Bugzilla 2.18 rc3 Mozilla Bugzilla 2.18 rc2 Mozilla Bugzilla 2.18 rc1 Mozilla Bugzilla 2.17.7 Mozilla Bugzilla 2.17.6 Mozilla Bugzilla 2.17.5 Mozilla Bugzilla 2.17.4 Mozilla Bugzilla 2.17.3 Mozilla Bugzilla 2.17.1

Not Vulnerable:

Discussion

Bugzilla Authentication Information Disclosure Vulnerability

Bugzilla is prone to a vulnerability that could allow username and password information to be disclosed in generated links. Any user with access to the server's web logs could potentially gain access to the user's authentication information.

Exploit / POC

Bugzilla Authentication Information Disclosure Vulnerability

An exploit is not required.

Solution / Fix

Bugzilla Authentication Information Disclosure Vulnerability

Solution:
Please see the referenced advisories for details on obtaining and applying the appropriate updates.

Mozilla Bugzilla 2.17.1