Bugzilla 'time-tracking' Information Disclosure Vulnerability

Bugtraq ID:	41141
Class:	Access Validation Error
CVE:	CVE-2010-1204
Remote:	Yes
Local:	No
Published:	Jun 25 2010 12:00AM
Updated:	Apr 13 2015 09:30PM
Credit:	Reported by the Vendor
Vulnerable:	Mozilla Bugzilla 3.5.3 Mozilla Bugzilla 3.5.2 Mozilla Bugzilla 3.5.1 Mozilla Bugzilla 3.4.6 Mozilla Bugzilla 3.4.5 Mozilla Bugzilla 3.4.4 Mozilla Bugzilla 3.4.3 Mozilla Bugzilla 3.4.2 Mozilla Bugzilla 3.4.1 Mozilla Bugzilla 3.3.4 Mozilla Bugzilla 3.3.3 Mozilla Bugzilla 3.3.2 Mozilla Bugzilla 3.3.1 Mozilla Bugzilla 3.2.6 Mozilla Bugzilla 3.2.5 Mozilla Bugzilla 3.2.4 Mozilla Bugzilla 3.2.3 Mozilla Bugzilla 3.2.2 Mozilla Bugzilla 3.2.1 Mozilla Bugzilla 3.1.4 Mozilla Bugzilla 3.1.3 Mozilla Bugzilla 3.1.2 Mozilla Bugzilla 3.1.1 Mozilla Bugzilla 3.1 Mozilla Bugzilla 3.0.11 Mozilla Bugzilla 3.0.10 Mozilla Bugzilla 3.0.9 Mozilla Bugzilla 3.0.8 Mozilla Bugzilla 3.0.7 Mozilla Bugzilla 3.0.6 Mozilla Bugzilla 3.0.5 Mozilla Bugzilla 3.0.4 Mozilla Bugzilla 3.0.2 Mozilla Bugzilla 3.0.1 Mozilla Bugzilla 3.0 Mozilla Bugzilla 2.23.4 Mozilla Bugzilla 2.23.3 Mozilla Bugzilla 2.23.2 Mozilla Bugzilla 2.22.7 Mozilla Bugzilla 2.22.6 Mozilla Bugzilla 2.22.5 Mozilla Bugzilla 2.22.4 Mozilla Bugzilla 2.22.3 Mozilla Bugzilla 2.22.2 Mozilla Bugzilla 2.22.1 Mozilla Bugzilla 2.21.2 Mozilla Bugzilla 2.21.1 Mozilla Bugzilla 2.21 Mozilla Bugzilla 2.20.7 Mozilla Bugzilla 2.20.6 Mozilla Bugzilla 2.20.5 Mozilla Bugzilla 2.20.4 Mozilla Bugzilla 2.20.3 Mozilla Bugzilla 2.20.2 Mozilla Bugzilla 2.20.1 Mozilla Bugzilla 2.20 rc2 Mozilla Bugzilla 2.20 rc1 Mozilla Bugzilla 2.19.3 Mozilla Bugzilla 2.19.2 Mozilla Bugzilla 2.19.1 Mozilla Bugzilla 2.19 Mozilla Bugzilla 2.18.6 Mozilla Bugzilla 2.18.5 Mozilla Bugzilla 2.18.4 Mozilla Bugzilla 2.18.3 Mozilla Bugzilla 2.18.2 Mozilla Bugzilla 2.18.1 Mozilla Bugzilla 2.18 rc3 Mozilla Bugzilla 2.18 rc2 Mozilla Bugzilla 2.18 rc1 Mozilla Bugzilla 2.17.7 Mozilla Bugzilla 2.17.6 Mozilla Bugzilla 2.17.5 Mozilla Bugzilla 2.17.4 Mozilla Bugzilla 2.17.3 Mozilla Bugzilla 2.17.2 Mozilla Bugzilla 2.17.1 Mozilla Bugzilla 2.9 Mozilla Bugzilla 2.8 - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows NT 3.5.1 - Microsoft Windows NT 3.5.1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Mozilla Bugzilla 2.6 Mozilla Bugzilla 2.4 Mozilla Bugzilla 3.7 Mozilla Bugzilla 3.6rc1 Mozilla Bugzilla 3.6 Mozilla Bugzilla 3.4 rc1 Mozilla Bugzilla 3.4 Mozilla Bugzilla 3.2 Mozilla Bugzilla 2.22 RC1 Mozilla Bugzilla 2.22 Mozilla Bugzilla 2.20
Not Vulnerable:	Mozilla Bugzilla 3.7.1 Mozilla Bugzilla 3.6.1 Mozilla Bugzilla 3.4.7 Mozilla Bugzilla 3.2.7

Bugzilla 'time-tracking' Information Disclosure Vulnerability

Bugzilla is prone to an information-disclosure vulnerability.

Exploits may allow attackers to obtain potentially sensitive information that may aid in other attacks.

This issue affects the following:

Bugzilla 2.17.1 through 3.2.6
Bugzilla 3.3.1 through 3.4.6
Bugzilla 3.5.1 through 3.6
Bugzilla 3.7

Bugzilla 'time-tracking' Information Disclosure Vulnerability

An attacker can exploit this issue via a browser.

Bugzilla 'time-tracking' Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for more information.

Bugzilla 'time-tracking' Information Disclosure Vulnerability

References:

• Bugzilla Homepage (Mozilla)
  
• 3.2.6, 3.4.6, 3.6.0, and 3.7.0 Security Advisory (Mozilla)