CVE-2005-3138

Bugzilla 2.18rc1 through 2.18.3, 2.19 through 2.20rc2, and 2.21 allows remote attackers to obtain sensitive information such as the list of installed products via the config.cgi file, which is accessible even when the requirelogin parameter is set.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://marc.info/?l=bugtraq&m=112818466125484&w=2
http://secunia.com/advisories/17030/	Patch Vendor Advisory
http://www.bugzilla.org/security/2.18.4/	Vendor Advisory
http://www.securityfocus.com/bid/14995	Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/22490

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mozilla:bugzilla:2.18:rc1::::::
	cpe:2.3:a:mozilla:bugzilla:2.18:rc2::::::
	cpe:2.3:a:mozilla:bugzilla:2.18:rc3::::::
	cpe:2.3:a:mozilla:bugzilla:2.18.1:::::::*
	cpe:2.3:a:mozilla:bugzilla:2.18.2:::::::*
	cpe:2.3:a:mozilla:bugzilla:2.18.3:::::::*
	cpe:2.3:a:mozilla:bugzilla:2.19:::::::*
	cpe:2.3:a:mozilla:bugzilla:2.19.1:::::::*
	cpe:2.3:a:mozilla:bugzilla:2.19.2:::::::*
	cpe:2.3:a:mozilla:bugzilla:2.19.3:::::::*
	cpe:2.3:a:mozilla:bugzilla:2.20:rc1::::::
	cpe:2.3:a:mozilla:bugzilla:2.20:rc2::::::
	cpe:2.3:a:mozilla:bugzilla:2.21:::::::*

History

No history.

Information

Published : 2005-10-05 21:02

Updated : 2017-07-11 01:33

NVD link : CVE-2005-3138

Mitre link : CVE-2005-3138

CVE.ORG link : CVE-2005-3138

JSON object : View

Products Affected

mozilla

bugzilla

CWE

NVD-CWE-Other

{"id": "CVE-2005-3138", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2005-10-05T21:02:00.000", "references": [{"url": "http://marc.info/?l=bugtraq&m=112818466125484&w=2", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/17030/", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.bugzilla.org/security/2.18.4/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/14995", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22490", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Bugzilla 2.18rc1 through 2.18.3, 2.19 through 2.20rc2, and 2.21 allows remote attackers to obtain sensitive information such as the list of installed products via the config.cgi file, which is accessible even when the requirelogin parameter is set."}], "lastModified": "2017-07-11T01:33:06.487", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:bugzilla:2.18:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3635C0E9-2E43-4BAE-8267-2BB2F68B03BD"}, {"criteria": "cpe:2.3:a:mozilla:bugzilla:2.18:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4869A709-AF79-49BD-A7D2-D48A8D79A085"}, {"criteria": "cpe:2.3:a:mozilla:bugzilla:2.18:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EAC72143-27C3-498F-AFAB-98AE043C0545"}, {"criteria": "cpe:2.3:a:mozilla:bugzilla:2.18.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BE5E8E72-D493-460D-B5A0-F90C291398A5"}, {"criteria": "cpe:2.3:a:mozilla:bugzilla:2.18.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "04885D31-09F3-455F-A1A9-815E182ABCF9"}, {"criteria": "cpe:2.3:a:mozilla:bugzilla:2.18.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F153300E-42CC-4BDD-88EC-E8A0ADB4E3B7"}, {"criteria": "cpe:2.3:a:mozilla:bugzilla:2.19:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "725BD7BE-1769-4032-ADA8-9ED15528C770"}, {"criteria": "cpe:2.3:a:mozilla:bugzilla:2.19.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "239D70F4-7D86-4A57-ACEF-440F68994FB6"}, {"criteria": "cpe:2.3:a:mozilla:bugzilla:2.19.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ABEE2C94-DA69-4A78-A15F-538383A7460E"}, {"criteria": "cpe:2.3:a:mozilla:bugzilla:2.19.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4F7CD64E-7FAA-40DC-B36E-8B7EB9D620FB"}, {"criteria": "cpe:2.3:a:mozilla:bugzilla:2.20:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B45F6C27-D89A-42A0-A304-5B0C57D2A9F1"}, {"criteria": "cpe:2.3:a:mozilla:bugzilla:2.20:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "196B7CD8-D721-4CFB-B126-78758128E900"}, {"criteria": "cpe:2.3:a:mozilla:bugzilla:2.21:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2053CFB4-602E-4141-BB3D-A440E2A31D85"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}