CVE-2005-3139
First published: Wed Oct 05 2005(Updated: )
Bugzilla 2.19.1 through 2.20rc2 and 2.21, with user matching turned on in substring mode, allows attackers to list all users whose names match an arbitrary substring, even when the usevisibilitygroups parameter is set.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Bugzilla | =2.19.3 | |
| Mozilla Bugzilla | =2.20-rc2 | |
| Mozilla Bugzilla | =2.20-rc1 | |
| Mozilla Bugzilla | =2.19.1 | |
| Mozilla Bugzilla | =2.21 | |
| Mozilla Bugzilla | =2.19.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2005-3139?
CVE-2005-3139 is considered a moderate severity vulnerability as it allows unauthorized user enumeration.
How do I fix CVE-2005-3139?
To fix CVE-2005-3139, upgrade to Bugzilla version 2.21 or later, where the vulnerability has been addressed.
Which versions of Bugzilla are affected by CVE-2005-3139?
CVE-2005-3139 affects Bugzilla versions 2.19.1 through 2.20rc2 and the version 2.21.
What is the impact of CVE-2005-3139?
The impact of CVE-2005-3139 is that attackers can list all users with matching names causing potential data leakage.
Is user matching turned on in substring mode related to CVE-2005-3139?
Yes, the vulnerability occurs specifically when user matching is turned on in substring mode.
- collector/nvd-historical
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/last-modified-date
- agent/severity
- agent/remedy
- agent/author
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- vendor/mozilla
- canonical/mozilla bugzilla
- version/mozilla bugzilla/2.19.3
- version/mozilla bugzilla/2.20-rc2
- version/mozilla bugzilla/2.20-rc1
- version/mozilla bugzilla/2.19.1
- version/mozilla bugzilla/2.21
- version/mozilla bugzilla/2.19.2