BID:37062

Bugzilla Bug Alias Information Disclosure Vulnerability

Info

Bugzilla Bug Alias Information Disclosure Vulnerability

Bugtraq ID:	37062
Class:	Access Validation Error
CVE:	CVE-2009-3386
Remote:	Yes
Local:	No
Published:	Nov 18 2009 12:00AM
Updated:	Apr 13 2015 09:41PM
Credit:	Dave Miller, Fr&amp;amp;eacute;d&amp;amp;eacute;ric Buclin, Max Kanat-Alexander, Jesse Ruderman
Vulnerable:	Mozilla Bugzilla 3.5.1 Mozilla Bugzilla 3.4.3 Mozilla Bugzilla 3.4.2 Mozilla Bugzilla 3.4.1 Mozilla Bugzilla 3.3.4 Mozilla Bugzilla 3.3.3 Mozilla Bugzilla 3.3.2 Mozilla Bugzilla 3.5 Mozilla Bugzilla 3.4 rc1 Mozilla Bugzilla 3.4

Not Vulnerable:	Mozilla Bugzilla 3.5.2 Mozilla Bugzilla 3.4.4

Discussion

Bugzilla Bug Alias Information Disclosure Vulnerability

Bugzilla is prone to an information-disclosure vulnerability.

The issue may allow attackers to obtain potentially sensitive information that may aid in other attacks.

The issue affects the following:

Bugzilla 3.3.2 through 3.4.3
Bugzilla 3.5 through 3.5.1

Exploit / POC

Bugzilla Bug Alias Information Disclosure Vulnerability

An attacker can exploit this issue via a browser.

Solution / Fix

Bugzilla Bug Alias Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for more information.

Mozilla Bugzilla 3.4 rc1