Code injection

2012-11-1612:24:00

PRIOn knowledge base

www.prio-n.com

6.4 Medium

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

68.2%

JSON

template/en/default/bug/field-events.js.tmpl in Bugzilla 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 generates JavaScript function calls containing private product names or private component names in certain circumstances involving custom-field visibility control, which allows remote attackers to obtain sensitive information by reading HTML source code.

CPENameOperatorVersion
bugzillaeq3.0.4
bugzillaeq3.0 rc1
bugzillaeq3.6.9
bugzillaeq3.1.3
bugzillaeq3.0.0
bugzillaeq3.4.3
bugzillale3.6.11
bugzillaeq3.3.2
bugzillaeq3.0.1
bugzillaeq3.2 rc1

Name	Operator	Version
bugzilla	eq	3.0.4
bugzilla	eq	3.0 rc1
bugzilla	eq	3.6.9
bugzilla	eq	3.1.3
bugzilla	eq	3.0.0
bugzilla	eq	3.4.3
bugzilla	le	3.6.11
bugzilla	eq	3.3.2
bugzilla	eq	3.0.1
bugzilla	eq	3.2 rc1