Bugzilla < 2.19.3 Information Disclosure

Low Nessus Network Monitor Plugin ID 2900

Synopsis

The remote host may give an attacker information useful for future attacks.

Description

The remote server is running Bugzilla, a bug tracking system. There is a flaw in the remote installation of Bugzilla that may allow an attacker to disclose sensitive information. Specifically, if a user generates a report prior to authentication, the user ID and password will be embedded within the report. An attacker exploiting this flaw would be able to harvest user IDs and passwords from generated reports.

Solution

Upgrade to version 2.19.3 or higher.

See Also

http://www.bugzilla.org/security/2.16.8

Plugin Details

Severity: Low

ID: 2900

File Name: 2900.prm

Family: CGI

Published: 2005/05/12

Modified: 2016/02/05

Dependencies: 1442

Nessus ID: 18245

Risk Information

Risk Factor: Low

CVSSv2

Base Score: 2.1

Temporal Score: 1.8

Vector: CVSS2#AV:N/AC:H/Au:S/C:P/I:N/A:N

Temporal Vector: CVSS2#E:H/RL:OF/RC:C

CVSSv3

Base Score: 3

Temporal Score: 2.8

Vector: CVSS3#AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS3#E:H/RL:O/RC:C

Reference Information

CVE: CVE-2005-1565, CVE-2005-1563, CVE-2005-1564

BID: 13605, 13606