medium4.3
CVE-2009-3989
Bugzilla before 3.0.11, 3.2.x before 3.2.6, 3.4.x before 3.4.5, and 3.5.x before 3.5.3 does not block access to files and directories that are used by custom i…
Impact
Bugzilla before 3.0.11, 3.2.x before 3.2.6, 3.4.x before 3.4.5, and 3.5.x before 3.5.3 does not block access to files and directories that are used by custom installations, which allows remote attackers to obtain sensitive information via requests for (1) CVS/, (2) contrib/, (3) docs/en/xml/, (4) t/, or (5) old-params.txt.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mozilla | Bugzilla | through 3.0.10 Versions 2.0, 2.2, 2.4, 2.6, 2.8 |
Weakness classification
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/38443
- http://www.securityfocus.com/archive/1/509282/100/0/threaded
- http://www.securityfocus.com/bid/38025
- http://www.vupen.com/english/advisories/2010/0261
- https://bugzilla.mozilla.org/show_bug.cgi?id=314871
- https://bugzilla.mozilla.org/show_bug.cgi?id=434801
- https://exchange.xforce.ibmcloud.com/vulnerabilities/56003
- http://secunia.com/advisories/38443
- http://www.securityfocus.com/archive/1/509282/100/0/threaded
- http://www.securityfocus.com/bid/38025
- http://www.vupen.com/english/advisories/2010/0261
- https://bugzilla.mozilla.org/show_bug.cgi?id=314871
- https://bugzilla.mozilla.org/show_bug.cgi?id=434801
- https://exchange.xforce.ibmcloud.com/vulnerabilities/56003