Information disclosure in Mozilla Bugzilla
CVE-2012-4197
Bugzilla/Attachment.pm in attachment.cgi in Bugzilla 2.x and 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 allows remote attackers to read attachment descriptions from private bugs via an obsolete=1 insert action.
Vulnerability class: Information Disclosure
EPSS: 0.015 (72.4th percentile) — read the EPSS interpretation.
Affected products
- Mozilla Bugzilla — versions 2.0, 2.2, 2.4
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_CONFIRM, Exploit, Patch)
- cve@mitre.org (vendor-advisory, x_refsource_MANDRIVA)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (x_refsource_CONFIRM)