Bugzilla/Attachment.pm in attachment.cgi in Bugzilla 2.x and 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 allows remote attackers to read attachment descriptions from private bugs via an obsolete=1 insert action.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
Configuration 6 (hide)
|
Configuration 7 (hide)
|
History
21 Nov 2024, 01:42
Type | Values Removed | Values Added |
---|---|---|
References | () http://www.bugzilla.org/security/3.6.11/ - | |
References | () http://www.mandriva.com/security/advisories?name=MDVSA-2013:066 - | |
References | () https://bugzilla.mozilla.org/show_bug.cgi?id=802204 - Exploit, Patch | |
References | () https://exchange.xforce.ibmcloud.com/vulnerabilities/80032 - |
Information
Published : 2012-11-16 12:24
Updated : 2024-11-21 01:42
NVD link : CVE-2012-4197
Mitre link : CVE-2012-4197
CVE.ORG link : CVE-2012-4197
JSON object : View
Products Affected
mozilla
- bugzilla
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor