Search.pm in Bugzilla 2.19.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2 allows remote attackers to determine the group memberships of arbitrary users via vectors involving the Search interface, boolean charts, and group-based pronouns.
| Version | Base score | Base severity | Vector |
|---|
| Hyperlink | Resource Type |
|---|
Search.pm in Bugzilla 2.19.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2 allows remote attackers to determine the group memberships of arbitrary users via vectors involving the Search interface, boolean charts, and group-based pronouns.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://www.vupen.com/english/advisories/2010/2035 | vdb-entry x_refsource_VUPEN |
| http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046534.html | vendor-advisory x_refsource_FEDORA |
| http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046518.html | vendor-advisory x_refsource_FEDORA |
| http://secunia.com/advisories/40892 | third-party-advisory x_refsource_SECUNIA |
| https://bugzilla.redhat.com/show_bug.cgi?id=623423 | x_refsource_CONFIRM |
| http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046546.html | vendor-advisory x_refsource_FEDORA |
| http://www.securityfocus.com/bid/42275 | vdb-entry x_refsource_BID |
| https://bugzilla.mozilla.org/show_bug.cgi?id=417048 | x_refsource_CONFIRM |
| http://www.bugzilla.org/security/3.2.7/ | x_refsource_CONFIRM |
| http://secunia.com/advisories/41128 | third-party-advisory x_refsource_SECUNIA |
| http://www.vupen.com/english/advisories/2010/2205 | vdb-entry x_refsource_VUPEN |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
Search.pm in Bugzilla 2.19.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2 allows remote attackers to determine the group memberships of arbitrary users via vectors involving the Search interface, boolean charts, and group-based pronouns.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 2.0 | 5.0 | MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |