CVE-2009-3166

token.cgi in Bugzilla 3.4rc1 through 3.4.1 places a password in a URL at the beginning of a login session that occurs immediately after a password reset, which allows context-dependent attackers to discover passwords by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/36718	Vendor Advisory
http://www.bugzilla.org/security/3.0.8/	Patch Vendor Advisory
http://www.securityfocus.com/bid/36372	Patch
http://www.securitytracker.com/id?1022902
https://bugzilla.mozilla.org/show_bug.cgi?id=508189	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mozilla:bugzilla:3.4:::::::*
	cpe:2.3:a:mozilla:bugzilla:3.4:rc1::::::
	cpe:2.3:a:mozilla:bugzilla:3.4.1:::::::*

History

No history.

Information

Published : 2009-09-15 22:30

Updated : 2009-09-19 05:32

NVD link : CVE-2009-3166

Mitre link : CVE-2009-3166

CVE.ORG link : CVE-2009-3166

JSON object : View

Products Affected

mozilla

bugzilla

CWE

CWE-255

Credentials Management Errors

{"id": "CVE-2009-3166", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-09-15T22:30:00.407", "references": [{"url": "http://secunia.com/advisories/36718", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.bugzilla.org/security/3.0.8/", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/36372", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id?1022902", "source": "cve@mitre.org"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=508189", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-255"}]}], "descriptions": [{"lang": "en", "value": "token.cgi in Bugzilla 3.4rc1 through 3.4.1 places a password in a URL at the beginning of a login session that occurs immediately after a password reset, which allows context-dependent attackers to discover passwords by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history."}, {"lang": "es", "value": "token.cgi en Bugzilla v3.4rc1 hasta v3.4.1 coloca una contrase\u00f1a en una URL al comienzo del inicio de sesi\u00f3n que ocurre inmediatamente despu\u00e9s del restablecimiento de la contrase\u00f1a, lo que permite dependiendo del contexto a atacantes descubrir contrase\u00f1as leyendo (1) logs de acceso del servidor web, (2) logs Referer del servidor web, o (3) el historial del navegador."}], "lastModified": "2009-09-19T05:32:17.063", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:bugzilla:3.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D6A71919-DC70-4AE2-9D16-76A177DAE331"}, {"criteria": "cpe:2.3:a:mozilla:bugzilla:3.4:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "780896D3-3B49-486F-A136-D3D175C00A34"}, {"criteria": "cpe:2.3:a:mozilla:bugzilla:3.4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EA43E47B-F474-4F5B-A91B-9AF99359FE5F"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}