The WebService (XML-RPC) interface in Bugzilla 2.23.3 up to and including 3.0.0 does not enforce permissions for the time-tracking fields of bugs, which allows remote malicious users to obtain sensitive information via certain XML-RPC requests, as demonstrated by the (1) Deadline and (2) Estimated Time fields.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
mozilla bugzilla 2.6 |
||
mozilla bugzilla 2.8 |
||
mozilla bugzilla 2.23.4 |
||
mozilla bugzilla 2.4 |
||
mozilla bugzilla 2.9 |
||
mozilla bugzilla 3.0.0 |
||
mozilla bugzilla 2.23.3 |