Bugzilla before 3.0.11, 3.2.x before 3.2.6, 3.4.x before 3.4.5, and 3.5.x before 3.5.3 does not block access to files and directories that are used by custom installations, which allows remote attackers to obtain sensitive information via requests for (1) CVS/, (2) contrib/, (3) docs/en/xml/, (4) t/, or (5) old-params.txt.
| Version | Base score | Base severity | Vector |
|---|
| Hyperlink | Resource Type |
|---|
Bugzilla before 3.0.11, 3.2.x before 3.2.6, 3.4.x before 3.4.5, and 3.5.x before 3.5.3 does not block access to files and directories that are used by custom installations, which allows remote attackers to obtain sensitive information via requests for (1) CVS/, (2) contrib/, (3) docs/en/xml/, (4) t/, or (5) old-params.txt.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=314871 | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/56003 | vdb-entry x_refsource_XF |
| https://bugzilla.mozilla.org/show_bug.cgi?id=434801 | x_refsource_CONFIRM |
| http://www.vupen.com/english/advisories/2010/0261 | vdb-entry x_refsource_VUPEN |
| http://www.securityfocus.com/bid/38025 | vdb-entry x_refsource_BID |
| http://www.securityfocus.com/archive/1/509282/100/0/threaded | mailing-list x_refsource_BUGTRAQ |
| http://secunia.com/advisories/38443 | third-party-advisory x_refsource_SECUNIA |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=314871 | x_refsource_CONFIRM x_transferred |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/56003 | vdb-entry x_refsource_XF x_transferred |
| https://bugzilla.mozilla.org/show_bug.cgi?id=434801 | x_refsource_CONFIRM x_transferred |
| http://www.vupen.com/english/advisories/2010/0261 | vdb-entry x_refsource_VUPEN x_transferred |
| http://www.securityfocus.com/bid/38025 | vdb-entry x_refsource_BID x_transferred |
| http://www.securityfocus.com/archive/1/509282/100/0/threaded | mailing-list x_refsource_BUGTRAQ x_transferred |
| http://secunia.com/advisories/38443 | third-party-advisory x_refsource_SECUNIA x_transferred |
Bugzilla before 3.0.11, 3.2.x before 3.2.6, 3.4.x before 3.4.5, and 3.5.x before 3.5.3 does not block access to files and directories that are used by custom installations, which allows remote attackers to obtain sensitive information via requests for (1) CVS/, (2) contrib/, (3) docs/en/xml/, (4) t/, or (5) old-params.txt.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 2.0 | 4.3 | MEDIUM | AV:N/AC:M/Au:N/C:P/I:N/A:N |