CVE-2011-2979
 
Severity Score
5.0
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Bugzilla 4.1.x before 4.1.3 generates different responses for certain assignee queries depending on whether the group name is valid, which allows remote attackers to determine the existence of private group names via a custom search. NOTE: this vulnerability exists because of a CVE-2010-2756 regression.
Bugzilla 4.1.x anteriores a 4.1.3 genera respuestas distintas a peticiones determinadas sobre la persona asignada ("assignee") dependiendo de si el nombre del grupo es válido, lo que permite a atacantes remotos determinar la existencia de nombres de grupos privados a través de una búsqueda. NOTE: esta vulnerabilidad existe debido a una regresión de CVE-2010-2756.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2011-08-01 CVE Reserved
- 2011-08-09 CVE Published
- 2024-08-06 CVE Updated
- 2024-08-06 First Exploit
- 2024-10-09 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
CAPEC
References (8)
URL | Tag | Source |
---|---|---|
http://www.osvdb.org/74298 | Vdb Entry | |
http://www.osvdb.org/74299 | Vdb Entry | |
http://www.securityfocus.com/bid/49042 | Vdb Entry | |
https://exchange.xforce.ibmcloud.com/vulnerabilities/69166 | Vdb Entry |
URL | Date | SRC |
---|---|---|
https://bugzilla.mozilla.org/show_bug.cgi?id=674497 | 2024-08-06 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
http://secunia.com/advisories/45501 | 2017-08-29 | |
http://www.bugzilla.org/security/3.4.11 | 2017-08-29 | |
http://www.debian.org/security/2011/dsa-2322 | 2017-08-29 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Mozilla Search vendor "Mozilla" | Bugzilla Search vendor "Mozilla" for product "Bugzilla" | 4.1 Search vendor "Mozilla" for product "Bugzilla" and version "4.1" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Bugzilla Search vendor "Mozilla" for product "Bugzilla" | 4.1.1 Search vendor "Mozilla" for product "Bugzilla" and version "4.1.1" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Bugzilla Search vendor "Mozilla" for product "Bugzilla" | 4.1.2 Search vendor "Mozilla" for product "Bugzilla" and version "4.1.2" | - |
Affected
|