Bugzilla 2.14 prior to 2.14.2, and 2.16 prior to 2.16rc2, directs error messages from the syncshadowdb command to the HTML output, which could leak sensitive information, including plaintext passwords, if syncshadowdb fails.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
mozilla bugzilla 2.14 |
||
mozilla bugzilla 2.14.1 |
||
mozilla bugzilla 2.16 |