Bugzilla < 2.19.3 Information Disclosure

Low Nessus Network Monitor Plugin ID 2900


The remote host may give an attacker information useful for future attacks.


The remote server is running Bugzilla, a bug tracking system. There is a flaw in the remote installation of Bugzilla that may allow an attacker to disclose sensitive information. Specifically, if a user generates a report prior to authentication, the user ID and password will be embedded within the report. An attacker exploiting this flaw would be able to harvest user IDs and passwords from generated reports.


Upgrade to version 2.19.3 or higher.

See Also


Plugin Details

Severity: Low

ID: 2900

File Name: 2900.prm

Family: CGI

Published: 2005/05/12

Modified: 2016/02/05

Dependencies: 1442

Nessus ID: 18245

Risk Information

Risk Factor: Low


Base Score: 2.1

Temporal Score: 1.8

Vector: CVSS2#AV:N/AC:H/Au:S/C:P/I:N/A:N

Temporal Vector: CVSS2#E:H/RL:OF/RC:C


Base Score: 3

Temporal Score: 2.8


Temporal Vector: CVSS3#E:H/RL:O/RC:C

Reference Information

CVE: CVE-2005-1565, CVE-2005-1563, CVE-2005-1564

BID: 13605, 13606