4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
0.002 Low
EPSS
Percentile
56.1%
Bugzilla 4.1.x and 4.2.x before 4.2.2 and 4.3.x before 4.3.2 uses
bug-editor privileges instead of bugmail-recipient privileges during
construction of HTML bugmail documents, which allows remote attackers to
obtain sensitive description information by reading the tooltip portions of
an HTML e-mail message.