Vulnerability CVE-2006-5454
Published: 2006-10-23   Modified: 2012-02-12

Description:
Bugzilla 2.18.x before 2.18.6, 2.20.x before 2.20.3, 2.22.x before 2.22.1, and 2.23.x before 2.23.3 allow remote attackers to obtain (1) the description of arbitrary attachments by viewing the attachment in "diff" mode in attachment.cgi, and (2) the deadline field by viewing the XML format of the bug in show_bug.cgi.

See advisories in our WLB2 database:
Topic
Author
Date
Low
Security Advisory for Bugzilla 2.18.5, 2.20.2, 2.22, and 2.23.2
The Bugzilla tea...
24.10.2006

Type:

CWE-Other

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
Mozilla -> Bugzilla 

 References:
http://security.gentoo.org/glsa/glsa-200611-04.xml
http://securityreason.com/securityalert/1760
http://securitytracker.com/id?1017064
http://www.bugzilla.org/security/2.18.5/
http://www.securityfocus.com/archive/1/448777/100/100/threaded
http://www.securityfocus.com/bid/20538
http://www.vupen.com/english/advisories/2006/4035
https://bugzilla.mozilla.org/show_bug.cgi?id=346086
https://bugzilla.mozilla.org/show_bug.cgi?id=346564
Copyright 2026, cxsecurity.com

 

Back to Top