CVE-2004-1634: Medium severity Bugzilla vulnerability

Published Oct 25, 2004

Updated

showbug.cgi in Bugzilla 2.17.1 through 2.18rc2 and 2.19 from CVS, when using the insidergroup feature and exporting a bug to XML, shows comments and attachment summaries which are marked as private, which allows remote attackers to gain sensitive information.

Affected Software

26 affected components

Bugzilla=2.4

Bugzilla=2.6

Bugzilla=2.8

Bugzilla=2.10

Bugzilla=2.12

Bugzilla=2.14

Bugzilla=2.14.1

Bugzilla=2.14.2

Bugzilla=2.14.3

Bugzilla=2.14.4

Bugzilla=2.14.5

Bugzilla=2.16

Bugzilla=2.16.1

Bugzilla=2.16.2

Bugzilla=2.16.3

Bugzilla=2.16.4

Bugzilla=2.16.5

Bugzilla=2.17

Bugzilla=2.17.1

Bugzilla=2.17.3

Bugzilla=2.17.4

Bugzilla=2.17.5

Bugzilla=2.17.6

Bugzilla=2.17.7

Bugzilla=2.18-rc1

Bugzilla=2.18-rc2

Remediation

Patch Available

http://www.securityfocus.com/bid/11511

Event History

Oct 25, 2004

CVE Published

04:00 AM

Feb 20, 2005

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-1634?

CVE-2004-1634 is classified as a medium severity vulnerability due to its potential to expose private comments and attachment summaries.

How do I fix CVE-2004-1634?

To fix CVE-2004-1634, upgrade to Bugzilla version 2.18 or later where this issue has been resolved.

What systems are affected by CVE-2004-1634?

CVE-2004-1634 affects Bugzilla versions 2.17.1 through 2.18rc2 and various earlier versions.

What type of vulnerability is CVE-2004-1634?

CVE-2004-1634 is an information disclosure vulnerability that allows remote attackers to access sensitive information.

Is CVE-2004-1634 a remote attack vulnerability?

Yes, CVE-2004-1634 can be exploited remotely, allowing attackers to retrieve private data without authentication.