CVE-2010-2470

2022-10-0316:21:08

CWE-264

mitre

web.nvd.nist.gov

cve-2010-2470

bugzilla

vulnerability

use_suexec

file permissions

CVSS2

1.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

AI Score

5.8

Confidence

Low

EPSS

Percentile

5.1%

JSON

Install/Filesystem.pm in Bugzilla 3.5.1 through 3.6.1 and 3.7 through 3.7.1, when use_suexec is enabled, uses world-readable permissions within (1) .bzr/ and (2) data/webdot/, which allows local users to obtain potentially sensitive data by reading files in these directories, a different vulnerability than CVE-2010-0180.

Affected configurations

Nvd

Node

mozillabugzillaMatch3.5.1

mozillabugzillaMatch3.5.2

mozillabugzillaMatch3.5.3

mozillabugzillaMatch3.6

mozillabugzillaMatch3.6rc1

mozillabugzillaMatch3.6.1

mozillabugzillaMatch3.7

mozillabugzillaMatch3.7.1

VendorProductVersionCPE
mozillabugzilla3.6cpe:/a:mozilla:bugzilla:3.6:rc1::
mozillabugzilla3.6.1cpe:/a:mozilla:bugzilla:3.6.1:::
mozillabugzilla3.5.3cpe:/a:mozilla:bugzilla:3.5.3:::
mozillabugzilla3.5.1cpe:/a:mozilla:bugzilla:3.5.1:::
mozillabugzilla3.7.1cpe:/a:mozilla:bugzilla:3.7.1:::
mozillabugzilla3.7cpe:/a:mozilla:bugzilla:3.7:::
mozillabugzilla3.6cpe:/a:mozilla:bugzilla:3.6:::
mozillabugzilla3.5.2cpe:/a:mozilla:bugzilla:3.5.2:::

Vendor	Product	Version	CPE
mozilla	bugzilla	3.6	cpe:/a:mozilla:bugzilla:3.6:rc1::
mozilla	bugzilla	3.6.1	cpe:/a:mozilla:bugzilla:3.6.1:::
mozilla	bugzilla	3.5.3	cpe:/a:mozilla:bugzilla:3.5.3:::
mozilla	bugzilla	3.5.1	cpe:/a:mozilla:bugzilla:3.5.1:::
mozilla	bugzilla	3.7.1	cpe:/a:mozilla:bugzilla:3.7.1:::
mozilla	bugzilla	3.7	cpe:/a:mozilla:bugzilla:3.7:::
mozilla	bugzilla	3.6	cpe:/a:mozilla:bugzilla:3.6:::
mozilla	bugzilla	3.5.2	cpe:/a:mozilla:bugzilla:3.5.2:::