CVE-2010-2470

2010-06-2817:30:01

CWE-264

[email protected]

web.nvd.nist.gov

CVSS2

1.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

AI Score

5.8

Confidence

Low

EPSS

Percentile

5.1%

JSON

Install/Filesystem.pm in Bugzilla 3.5.1 through 3.6.1 and 3.7 through 3.7.1, when use_suexec is enabled, uses world-readable permissions within (1) .bzr/ and (2) data/webdot/, which allows local users to obtain potentially sensitive data by reading files in these directories, a different vulnerability than CVE-2010-0180.

Affected configurations

Nvd

Node

mozillabugzillaMatch3.5.1

mozillabugzillaMatch3.5.2

mozillabugzillaMatch3.5.3

mozillabugzillaMatch3.6

mozillabugzillaMatch3.6rc1

mozillabugzillaMatch3.6.1

mozillabugzillaMatch3.7

mozillabugzillaMatch3.7.1

VendorProductVersionCPE
mozillabugzilla3.5.1cpe:2.3:a:mozilla:bugzilla:3.5.1:*:*:*:*:*:*:*
mozillabugzilla3.5.2cpe:2.3:a:mozilla:bugzilla:3.5.2:*:*:*:*:*:*:*
mozillabugzilla3.5.3cpe:2.3:a:mozilla:bugzilla:3.5.3:*:*:*:*:*:*:*
mozillabugzilla3.6cpe:2.3:a:mozilla:bugzilla:3.6:*:*:*:*:*:*:*
mozillabugzilla3.6cpe:2.3:a:mozilla:bugzilla:3.6:rc1:*:*:*:*:*:*
mozillabugzilla3.6.1cpe:2.3:a:mozilla:bugzilla:3.6.1:*:*:*:*:*:*:*
mozillabugzilla3.7cpe:2.3:a:mozilla:bugzilla:3.7:*:*:*:*:*:*:*
mozillabugzilla3.7.1cpe:2.3:a:mozilla:bugzilla:3.7.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mozilla	bugzilla	3.5.1	cpe:2.3:a:mozilla:bugzilla:3.5.1:::::::*
mozilla	bugzilla	3.5.2	cpe:2.3:a:mozilla:bugzilla:3.5.2:::::::*
mozilla	bugzilla	3.5.3	cpe:2.3:a:mozilla:bugzilla:3.5.3:::::::*
mozilla	bugzilla	3.6	cpe:2.3:a:mozilla:bugzilla:3.6:::::::*
mozilla	bugzilla	3.6	cpe:2.3:a:mozilla:bugzilla:3.6:rc1::::::
mozilla	bugzilla	3.6.1	cpe:2.3:a:mozilla:bugzilla:3.6.1:::::::*
mozilla	bugzilla	3.7	cpe:2.3:a:mozilla:bugzilla:3.7:::::::*
mozilla	bugzilla	3.7.1	cpe:2.3:a:mozilla:bugzilla:3.7.1:::::::*