CVE-2007-4539

2007-08-2721:17:00

CWE-264

mitre

web.nvd.nist.gov

bugzilla

webservice

xml-rpc

cve-2007-4539

security vulnerability

information disclosure

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

Confidence

Low

EPSS

0.004

Percentile

73.9%

JSON

The WebService (XML-RPC) interface in Bugzilla 2.23.3 through 3.0.0 does not enforce permissions for the time-tracking fields of bugs, which allows remote attackers to obtain sensitive information via certain XML-RPC requests, as demonstrated by the (1) Deadline and (2) Estimated Time fields.

Affected configurations

Nvd

Node

mozillabugzillaMatch2.4

mozillabugzillaMatch2.6

mozillabugzillaMatch2.8

mozillabugzillaMatch2.9

mozillabugzillaMatch2.23.3

mozillabugzillaMatch2.23.4

mozillabugzillaMatch3.0.0

VendorProductVersionCPE
mozillabugzilla2.4cpe:2.3:a:mozilla:bugzilla:2.4:*:*:*:*:*:*:*
mozillabugzilla2.6cpe:2.3:a:mozilla:bugzilla:2.6:*:*:*:*:*:*:*
mozillabugzilla2.8cpe:2.3:a:mozilla:bugzilla:2.8:*:*:*:*:*:*:*
mozillabugzilla2.9cpe:2.3:a:mozilla:bugzilla:2.9:*:*:*:*:*:*:*
mozillabugzilla2.23.3cpe:2.3:a:mozilla:bugzilla:2.23.3:*:*:*:*:*:*:*
mozillabugzilla2.23.4cpe:2.3:a:mozilla:bugzilla:2.23.4:*:*:*:*:*:*:*
mozillabugzilla3.0.0cpe:2.3:a:mozilla:bugzilla:3.0.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mozilla	bugzilla	2.4	cpe:2.3:a:mozilla:bugzilla:2.4:::::::*
mozilla	bugzilla	2.6	cpe:2.3:a:mozilla:bugzilla:2.6:::::::*
mozilla	bugzilla	2.8	cpe:2.3:a:mozilla:bugzilla:2.8:::::::*
mozilla	bugzilla	2.9	cpe:2.3:a:mozilla:bugzilla:2.9:::::::*
mozilla	bugzilla	2.23.3	cpe:2.3:a:mozilla:bugzilla:2.23.3:::::::*
mozilla	bugzilla	2.23.4	cpe:2.3:a:mozilla:bugzilla:2.23.4:::::::*
mozilla	bugzilla	3.0.0	cpe:2.3:a:mozilla:bugzilla:3.0.0:::::::*