CVE-2011-2979

UNKNOWN

Bugzilla 4

Published Aug 9, 2011

Modified 1 years ago

Details

Bugzilla 4.1.x before 4.1.3 generates different responses for certain assignee queries depending on whether the group name is valid, which allows remote attackers to determine the existence of private group names via a custom search. NOTE: this vulnerability exists because of a CVE-2010-2756 regression.

References

ADVISORYhttp://secunia.com/advisories/45501 WEBhttp://www.bugzilla.org/security/3.4.11/ADVISORYhttp://www.debian.org/security/2011/dsa-2322 WEBhttp://www.osvdb.org/74298 WEBhttp://www.osvdb.org/74299 WEBhttp://www.securityfocus.com/bid/49042 WEBhttps://bugzilla.mozilla.org/show_bug.cgi?id=674497 WEBhttps://exchange.xforce.ibmcloud.com/vulnerabilities/69166 ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2011-2979

CVSS Analysis

CVSS v2.0

5.0

Exploitability

Access Vector

NetworkAV:N

Access Complexity

LowAC:L

Authentication

NoneAu:N

Impact

Confidentiality

PartialC:P

Integrity

NoneI:N

Availability

NoneA:N

5/AV:N/AC:L/Au:N/C:P/I:N/A:N

Ecosystems

Timeline

PublishedAug 9, 2011

ModifiedAug 6, 2024

CVE-2011-2979 | Mondoo Vulnerability Intelligence