Ubuntu.comUB:CVE-2012-4198CVE-2012-4198
4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:N/A:N
0.001 Low
EPSS
Percentile
44.3%
The User.get method in Bugzilla/WebService/User.pm in Bugzilla 3.7.x and
4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x
before 4.4rc1 has a different outcome for a groups request depending on
whether a group exists, which allows remote authenticated users to discover
private group names by observing whether a call throws an error.
Bugs
Notes
| Author | Note |
|---|---|
| mdeslaur | 3.7.x+ only |
Related
4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:N/A:N
0.001 Low
EPSS
Percentile
44.3%