CVE-2009-3386

2009-11-2017:30:00

CWE-200

[email protected]

web.nvd.nist.gov

bugzilla

template.pm

cve-2009-3386

security

vulnerability

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

6.2 Medium

AI Score

Confidence

Low

0.006 Low

EPSS

Percentile

78.4%

JSON

Template.pm in Bugzilla 3.3.2 through 3.4.3 and 3.5 through 3.5.1 allows remote attackers to discover the alias of a private bug by reading the (1) Depends On or (2) Blocks field of a related bug.

Affected configurations

NVD

Node

mozillabugzillaMatch3.3.2

mozillabugzillaMatch3.3.3

mozillabugzillaMatch3.3.4

mozillabugzillaMatch3.4

mozillabugzillaMatch3.4rc1

mozillabugzillaMatch3.4.1

mozillabugzillaMatch3.4.2

mozillabugzillaMatch3.4.3

mozillabugzillaMatch3.5

mozillabugzillaMatch3.5.1

CPENameOperatorVersion
mozilla:bugzillamozilla bugzillaeq3.3.2
mozilla:bugzillamozilla bugzillaeq3.3.3
mozilla:bugzillamozilla bugzillaeq3.3.4
mozilla:bugzillamozilla bugzillaeq3.4
mozilla:bugzillamozilla bugzillaeq3.4.1
mozilla:bugzillamozilla bugzillaeq3.4.2
mozilla:bugzillamozilla bugzillaeq3.4.3
mozilla:bugzillamozilla bugzillaeq3.5
mozilla:bugzillamozilla bugzillaeq3.5.1

CPE	Name	Operator	Version
mozilla:bugzilla	mozilla bugzilla	eq	3.3.2
mozilla:bugzilla	mozilla bugzilla	eq	3.3.3
mozilla:bugzilla	mozilla bugzilla	eq	3.3.4
mozilla:bugzilla	mozilla bugzilla	eq	3.4
mozilla:bugzilla	mozilla bugzilla	eq	3.4.1
mozilla:bugzilla	mozilla bugzilla	eq	3.4.2
mozilla:bugzilla	mozilla bugzilla	eq	3.4.3
mozilla:bugzilla	mozilla bugzilla	eq	3.5
mozilla:bugzilla	mozilla bugzilla	eq	3.5.1