Bugzilla < 2.19.3 Information Disclosure
Low Nessus Network Monitor Plugin ID 2900
SynopsisThe remote host may give an attacker information useful for future attacks.
DescriptionThe remote server is running Bugzilla, a bug tracking system. There is a flaw in the remote installation of Bugzilla that may allow an attacker to disclose sensitive information. Specifically, if a user generates a report prior to authentication, the user ID and password will be embedded within the report. An attacker exploiting this flaw would be able to harvest user IDs and passwords from generated reports.
SolutionUpgrade to version 2.19.3 or higher.