Bugzilla < 3.0.9/3.2.5/3.4.2 Multiple Vulnerabilities

2009-09-1400:00:00

Tenable

www.tenable.com

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

0.003

Percentile

71.1%

JSON

The remote host is running Bugzilla, a bug-tracking software with a web interface. The version of Bugzilla on the remote host is potentially affected by multiple flaws :

A SQL injection vulnerability in the ‘Bug.search’ WebService function. (CVE-2009-3125)
A SQL injection vulnerability in the 'Bug.create WebService function. (CVE-2009-3165)
When a user reset their password and then logged in immediately afterward, their password would appear in the URL of their browser. (CVE-2009-3166)