CVEvulnerability
CVE-2012-1968
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2012-07-30
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-264
Description
Bugzilla 4.1.x and 4.2.x before 4.2.2 and 4.3.x before 4.3.2 uses bug-editor privileges instead of bugmail-recipient privileges during construction of HTML bugmail documents, which allows remote attackers to obtain sensitive description information by reading the tooltip portions of an HTML e-mail message.
Affected configurations
• mozilla bugzilla 4.1
• mozilla bugzilla 4.1.1
• mozilla bugzilla 4.1.2
• mozilla bugzilla 4.1.3
• mozilla bugzilla 4.2
• mozilla bugzilla 4.2.1
• mozilla bugzilla 4.3
• mozilla bugzilla 4.3.1
Related
Weakness · not in database (1)
References
- http://secunia.com/advisories/50040 secunia.com
- http://www.bugzilla.org/security/3.6.9/ Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=777398 Patch
- http://secunia.com/advisories/50040 secunia.com
- http://www.bugzilla.org/security/3.6.9/ Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=777398 Patch