BID:14995

Bugzilla config.cgi Information Disclosure Vulnerability

Info

Bugzilla config.cgi Information Disclosure Vulnerability

Bugtraq ID:	14995
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 01 2005 12:00AM
Updated:	Oct 01 2005 12:00AM
Credit:	Reported by <[email protected]>.
Vulnerable:	Mozilla Bugzilla 2.21 Mozilla Bugzilla 2.20 rc2 Mozilla Bugzilla 2.20 rc1 Mozilla Bugzilla 2.19.3 Mozilla Bugzilla 2.19.2 Mozilla Bugzilla 2.19.1 Mozilla Bugzilla 2.19 Mozilla Bugzilla 2.18.3 Mozilla Bugzilla 2.18.2 Mozilla Bugzilla 2.18.1 Mozilla Bugzilla 2.18 rc3 Mozilla Bugzilla 2.18 rc2 Mozilla Bugzilla 2.18 rc1

Not Vulnerable:	Mozilla Bugzilla 2.16.7 Mozilla Bugzilla 2.16.6 Mozilla Bugzilla 2.16.5 Mozilla Bugzilla 2.16.4 Mozilla Bugzilla 2.16.3 Mozilla Bugzilla 2.16.2 Mozilla Bugzilla 2.16.1 Mozilla Bugzilla 2.16 - Mandriva Linux Mandrake 9.0 - Mandriva Linux Mandrake 9.0

Discussion

Bugzilla config.cgi Information Disclosure Vulnerability

Bugzilla is prone to an information disclosure issue exposed through config.cgi. This may allow an unauthorized user to access product names that are supposed to be confidential.

Bugzilla versions 2.18rc1 to 2.18.3, 2.19 to 2.20rc2, and 2.21 are affected.

Exploit / POC

Bugzilla config.cgi Information Disclosure Vulnerability

An exploit is not required.

Solution / Fix

Bugzilla config.cgi Information Disclosure Vulnerability

Solution:
This issue has been addressed in Bugzilla 2.18.4, 2.20, and 2.21.1.

Mozilla Bugzilla 2.18 rc1