CVE-2012-4747

2012-09-0400:00:00

ubuntu.com

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

0.003

Percentile

65.7%

JSON

Bugzilla 2.x and 3.x through 3.6.11, 3.7.x and 4.0.x before 4.0.8, 4.1.x
and 4.2.x before 4.2.3, and 4.3.x before 4.3.3 stores potentially sensitive
information under the web root with insufficient access control, which
allows remote attackers to read (1) template (aka .tmpl) files, (2) other
custom extension files under extensions/, or (3) custom documentation files
under docs/ via a direct request.