CVE-2009-3387: Medium severity Bugzilla vulnerability

Published Feb 3, 2010

Updated

Bugzilla 3.3.1 through 3.4.4, 3.5.1, and 3.5.2 does not allow group restrictions to be preserved throughout the process of moving a bug to a different product category, which allows remote attackers to obtain sensitive information via a request for a bug in opportunistic circumstances.

Affected Software

10 affected components

Bugzilla=3.3.2

Bugzilla=3.4.2

Bugzilla=3.3.4

Bugzilla=3.5.2

Bugzilla=3.5.1

Bugzilla=3.4.1

Bugzilla=3.4.4

Bugzilla=3.3.3

Bugzilla=3.4

Bugzilla=3.3.1

Remediation

Patch Available

http://www.vupen.com/english/advisories/2010/0261

Event History

Feb 3, 2010

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Data Sourced

via NVD·07:30 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2009-3387?

CVE-2009-3387 has a moderate severity level due to its potential for exposing sensitive information.

How do I fix CVE-2009-3387?

To fix CVE-2009-3387, users should upgrade Bugzilla to a version that addresses this vulnerability, specifically a version higher than 3.5.2.

What versions of Bugzilla are affected by CVE-2009-3387?

CVE-2009-3387 affects Bugzilla versions 3.3.1 through 3.4.4, and versions 3.5.1 and 3.5.2.

What kind of attacks are possible with CVE-2009-3387?

CVE-2009-3387 may allow remote attackers to access sensitive bug information that should be restricted by group permissions.

Is there a workaround for CVE-2009-3387?

There is no known workaround for CVE-2009-3387; the only solution is to update to a patched version of Bugzilla.