CVE-2004-0702: Medium severity Bugzilla vulnerability

Published Jul 21, 2004

Updated

DBI in Bugzilla 2.17.1 through 2.17.7 displays the database password in an error message when the SQL server is not running, which could allow remote attackers to gain sensitive information.

Affected Software

24 affected components

Bugzilla=2.4

Bugzilla=2.6

Bugzilla=2.8

Bugzilla=2.10

Bugzilla=2.12

Bugzilla=2.14

Bugzilla=2.14.1

Bugzilla=2.14.2

Bugzilla=2.14.3

Bugzilla=2.14.4

Bugzilla=2.14.5

Bugzilla=2.16

Bugzilla=2.16.1

Bugzilla=2.16.2

Bugzilla=2.16.3

Bugzilla=2.16.4

Bugzilla=2.16.5

Bugzilla=2.17

Bugzilla=2.17.1

Bugzilla=2.17.3

Bugzilla=2.17.4

Bugzilla=2.17.5

Bugzilla=2.17.6

Bugzilla=2.17.7

Remediation

Patch Available

http://www.securityfocus.com/bid/10698

Event History

Jul 21, 2004

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-0702?

CVE-2004-0702 is considered a medium severity vulnerability due to its potential for exposing sensitive database information.

How do I fix CVE-2004-0702?

To fix CVE-2004-0702, upgrade to a patched version of Bugzilla that is not vulnerable to this issue.

Which versions of Bugzilla are affected by CVE-2004-0702?

CVE-2004-0702 affects Bugzilla versions 2.17.1 through 2.17.7, as well as several earlier versions.

What type of information is exposed by CVE-2004-0702?

CVE-2004-0702 can expose the database password in error messages if the SQL server is not running.

Are there any workarounds for CVE-2004-0702?

A possible workaround for CVE-2004-0702 is to configure error handling to prevent sensitive information from being displayed in error messages.