Vulnerability Details : CVE-2011-2979
Potential exploit
Bugzilla 4.1.x before 4.1.3 generates different responses for certain assignee queries depending on whether the group name is valid, which allows remote attackers to determine the existence of private group names via a custom search. NOTE: this vulnerability exists because of a CVE-2010-2756 regression.
Products affected by CVE-2011-2979
- cpe:2.3:a:mozilla:bugzilla:4.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:bugzilla:4.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:bugzilla:4.1.2:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2011-2979
0.69%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 69 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2011-2979
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST |
References for CVE-2011-2979
-
http://www.debian.org/security/2011/dsa-2322
Debian -- Security Information -- DSA-2322-1 bugzilla
-
http://secunia.com/advisories/45501
Sign inVendor Advisory
-
http://www.osvdb.org/74298
404 Not Found
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/69166
Bugzilla queries information disclosure CVE-2011-2979 Vulnerability Report
-
http://www.osvdb.org/74299
404 Not Found
-
https://bugzilla.mozilla.org/show_bug.cgi?id=674497
674497 - (CVE-2011-2979) [SECURITY] Custom searches let you determine if a group exists or notExploit;Patch
-
http://www.bugzilla.org/security/3.4.11/
4.1.2, 4.0.1, 3.6.5, and 3.4.11 Security Advisory :: Bugzilla :: bugzilla.orgVendor Advisory
-
http://www.securityfocus.com/bid/49042
Bugzilla Multiple Security Vulnerabilities
Jump to