CVE-2012-4198

2012-11-1612:24:00

CWE-200

[email protected]

web.nvd.nist.gov

bugzilla

webservice

user.pm

cve-2012-4198

information security

remote authentication

6 Medium

AI Score

Confidence

Low

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

44.4%

JSON

The User.get method in Bugzilla/WebService/User.pm in Bugzilla 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 has a different outcome for a groups request depending on whether a group exists, which allows remote authenticated users to discover private group names by observing whether a call throws an error.

CPENameOperatorVersion
mozilla:bugzillamozilla bugzillaeq3.7.2
mozilla:bugzillamozilla bugzillaeq3.7.1
mozilla:bugzillamozilla bugzillaeq3.7
mozilla:bugzillamozilla bugzillaeq3.7.3
mozilla:bugzillamozilla bugzillaeq4.0.1
mozilla:bugzillamozilla bugzillaeq4.0
mozilla:bugzillamozilla bugzillaeq4.0.2
mozilla:bugzillamozilla bugzillaeq4.0.5
mozilla:bugzillamozilla bugzillaeq4.0.7
mozilla:bugzillamozilla bugzillaeq4.0.8

CPE	Name	Operator	Version
mozilla:bugzilla	mozilla bugzilla	eq	3.7.2
mozilla:bugzilla	mozilla bugzilla	eq	3.7.1
mozilla:bugzilla	mozilla bugzilla	eq	3.7
mozilla:bugzilla	mozilla bugzilla	eq	3.7.3
mozilla:bugzilla	mozilla bugzilla	eq	4.0.1
mozilla:bugzilla	mozilla bugzilla	eq	4.0
mozilla:bugzilla	mozilla bugzilla	eq	4.0.2
mozilla:bugzilla	mozilla bugzilla	eq	4.0.5
mozilla:bugzilla	mozilla bugzilla	eq	4.0.7
mozilla:bugzilla	mozilla bugzilla	eq	4.0.8