CVE-2010-0180

2022-10-0316:21:10

CWE-264

mitre

web.nvd.nist.gov

cve-2010-0180

bugzilla

install/filesystem.pm

vulnerability

nvd

security

sensitive configuration

localconfig files

use_suexec

CVSS2

1.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

AI Score

6.1

Confidence

Low

EPSS

Percentile

5.1%

JSON

Install/Filesystem.pm in Bugzilla 3.5.1 through 3.6 and 3.7, when use_suexec is enabled, uses world-readable permissions for the localconfig files, which allows local users to read sensitive configuration fields, as demonstrated by the database password field and the site_wide_secret field.

Affected configurations

Nvd

Node

mozillabugzillaMatch3.5.1

mozillabugzillaMatch3.5.2

mozillabugzillaMatch3.5.3

mozillabugzillaMatch3.6

mozillabugzillaMatch3.7

VendorProductVersionCPE
mozillabugzilla3.6cpe:/a:mozilla:bugzilla:3.6:::
mozillabugzilla3.5.2cpe:/a:mozilla:bugzilla:3.5.2:::
mozillabugzilla3.5.1cpe:/a:mozilla:bugzilla:3.5.1:::
mozillabugzilla3.7cpe:/a:mozilla:bugzilla:3.7:::
mozillabugzilla3.5.3cpe:/a:mozilla:bugzilla:3.5.3:::

Vendor	Product	Version	CPE
mozilla	bugzilla	3.6	cpe:/a:mozilla:bugzilla:3.6:::
mozilla	bugzilla	3.5.2	cpe:/a:mozilla:bugzilla:3.5.2:::
mozilla	bugzilla	3.5.1	cpe:/a:mozilla:bugzilla:3.5.1:::
mozilla	bugzilla	3.7	cpe:/a:mozilla:bugzilla:3.7:::
mozilla	bugzilla	3.5.3	cpe:/a:mozilla:bugzilla:3.5.3:::