CVE-2010-2757: Medium severity Bugzilla vulnerability
Published Aug 13, 2010
·Updated
The sudo feature in Bugzilla 2.22rc1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2 does not properly send impersonation notifications, which makes it easier for remote authenticated users to impersonate other users without discovery.
Affected Software
61 affected components
Bugzilla=3.0.4
Bugzilla=3.0-rc1
Bugzilla=3.1.3
Bugzilla=3.0.0
Bugzilla=2.22.7
Bugzilla=3.7.2
Bugzilla=3.4.3
Bugzilla=3.3.2
Bugzilla=3.0.1
Bugzilla=3.6.1
Bugzilla=3.2.6
Bugzilla=3.1.1
Bugzilla=3.7.1
Bugzilla=3.7
Bugzilla=3.4.2
Bugzilla=3.1.2
Bugzilla=3.5.3
Bugzilla=3.2.5
Bugzilla=3.3.4
Bugzilla=2.22.3
Bugzilla=3.6
Bugzilla=2.22.6
Bugzilla=2.23.2
Bugzilla=3.2.3
Bugzilla=2.22.1
Bugzilla=2.23.4
Bugzilla=3.5.2
Bugzilla=3.0
Bugzilla=3.5.1
Bugzilla=3.0.11
Bugzilla=3.0.6
Bugzilla=2.23.3
Bugzilla=3.0.7
Bugzilla=2.23.1
Bugzilla=2.22-rc1
Bugzilla=2.22.5
Bugzilla=3.4.1
Bugzilla=3.4.4
Bugzilla=2.6
Bugzilla=3.4.7
Bugzilla=2.22
Bugzilla=3.1.0
Bugzilla=2.4
Bugzilla=3.0.3
Bugzilla=3.2
Bugzilla=3.0.9
Bugzilla=2.8
Bugzilla=3.2.4
Bugzilla=3.0.2
Bugzilla=3.3.3
Bugzilla=3.2.2
Bugzilla=3.0.10
Bugzilla=3.0.8
Bugzilla=2.23
Bugzilla=3.2.7
Bugzilla=2.9
Bugzilla=3.4.5
Bugzilla=3.0.5
Bugzilla=2.22.4
Bugzilla=3.3.1
Bugzilla=3.4.6
Event History
Aug 13, 2010
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2010-2757?
CVE-2010-2757 is classified as a moderate severity vulnerability.
2
Who is affected by CVE-2010-2757?
CVE-2010-2757 affects versions of Bugzilla from 2.22rc1 through 3.7.2.
3
What types of attacks can exploit CVE-2010-2757?
CVE-2010-2757 can be exploited by remote authenticated users to impersonate other users.
4
How do I fix CVE-2010-2757?
To fix CVE-2010-2757, upgrade to a fixed version of Bugzilla that addresses this vulnerability.
5
What impact does CVE-2010-2757 have on user privacy?
CVE-2010-2757 can compromise user privacy by allowing unauthorized impersonation without notifications.