CVE-2005-3138: Medium severity Bugzilla vulnerability
Published Oct 5, 2005
·Updated
Bugzilla 2.18rc1 through 2.18.3, 2.19 through 2.20rc2, and 2.21 allows remote attackers to obtain sensitive information such as the list of installed products via the config.cgi file, which is accessible even when the requirelogin parameter is set.
Affected Software
13 affected components
Bugzilla=2.18-rc1
Bugzilla=2.18-rc2
Bugzilla=2.18-rc3
Bugzilla=2.18.1
Bugzilla=2.18.2
Bugzilla=2.18.3
Bugzilla=2.19
Bugzilla=2.19.1
Bugzilla=2.19.2
Bugzilla=2.19.3
Bugzilla=2.20-rc1
Bugzilla=2.20-rc2
Bugzilla=2.21
Remediation
Patch Available
Patch Available
Event History
Oct 5, 2005
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2005-3138?
CVE-2005-3138 is classified as a moderate severity vulnerability.
2
What types of information can be exposed by CVE-2005-3138?
CVE-2005-3138 can expose sensitive information such as the list of installed products.
3
How can I mitigate CVE-2005-3138?
To mitigate CVE-2005-3138, update to Bugzilla version 2.18.4 or later.
4
Which versions of Bugzilla are affected by CVE-2005-3138?
CVE-2005-3138 affects Bugzilla versions 2.18rc1 through 2.18.3, 2.19 through 2.20rc2, and 2.21.
5
Is the config.cgi file supposed to be accessible according to CVE-2005-3138?
No, the config.cgi file should not be accessible even when the requirelogin parameter is set as per CVE-2005-3138.