CVE-2010-2758: Infoleak

Published Aug 13, 2010

Updated

Bugzilla 2.17.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2 generates different error messages depending on whether a product exists, which makes it easier for remote attackers to guess product names via unspecified use of the (1) Reports or (2) Duplicates page.

Affected Software

100 affected components

Bugzilla=3.0.4

Bugzilla=3.0-rc1

Bugzilla=3.1.3

Bugzilla=2.18.6\+

Bugzilla=3.0.0

Bugzilla=2.22.7

Bugzilla=3.7.2

Bugzilla=3.4.3

Bugzilla=3.3.2

Bugzilla=3.0.1

Bugzilla=2.18.8

Bugzilla=2.17.6

Bugzilla=2.18.5

Bugzilla=2.19.3

Bugzilla=2.20-rc2

Bugzilla=2.18.6

Bugzilla=2.17.2

Bugzilla=2.20-rc1

Bugzilla=2.20

Bugzilla=2.19

Bugzilla=2.18-rc1

Bugzilla=3.6.1

Bugzilla=3.2.6

Bugzilla=3.1.1

Bugzilla=3.7.1

Bugzilla=3.7

Bugzilla=3.4.2

Bugzilla=3.1.2

Bugzilla=3.5.3

Bugzilla=3.2.5

Bugzilla=3.3.4

Bugzilla=2.20.5

Bugzilla=2.20.6

Bugzilla=2.22.3

Bugzilla=3.6

Bugzilla=2.22.6

Bugzilla=2.17.4

Bugzilla=2.23.2

Bugzilla=2.21.2

Bugzilla=2.17.1

Bugzilla=3.2.3

Bugzilla=2.22.1

Bugzilla=2.23.4

Bugzilla=3.5.2

Bugzilla=3.0

Bugzilla=3.5.1

Bugzilla=3.0.11

Bugzilla=3.0.6

Bugzilla=2.20.1

Bugzilla=2.23.3

Bugzilla=3.0.7

Bugzilla=2.18.7

Bugzilla=2.23.1

Bugzilla=2.18.1

Bugzilla=2.22-rc1

Bugzilla=2.22.5

Bugzilla=3.4.1

Bugzilla=3.4.4

Bugzilla=2.19.1

Bugzilla=2.6

Bugzilla=3.4.7

Bugzilla=2.17.5

Bugzilla=2.22

Bugzilla=3.1.0

Bugzilla=2.17.3

Bugzilla=2.4

Bugzilla=3.0.3

Bugzilla=3.2

Bugzilla=2.20.3

Bugzilla=3.0.9

Bugzilla=2.8

Bugzilla=3.2.4

Bugzilla=2.2

Bugzilla=3.0.2

Bugzilla=3.3.3

Bugzilla=2.18.4

Bugzilla=3.2.2

Bugzilla=2.18.9

Bugzilla=2.18

Bugzilla=2.18.3

Bugzilla=2.17.7

Bugzilla=3.0.10

Bugzilla=2.20.7

Bugzilla=3.0.8

Bugzilla=2.20.2

Bugzilla=2.20.4

Bugzilla=2.21.1

Bugzilla=2.18-rc3

Bugzilla=2.23

Bugzilla=3.2.7

Bugzilla=2.9

Bugzilla=2.18.2

Bugzilla=2.18-rc2

Bugzilla=3.4.5

Bugzilla=3.0.5

Bugzilla=2.22.4

Bugzilla=2.21

Bugzilla=3.3.1

Bugzilla=3.4.6

Bugzilla=2.19.2

Event History

Aug 13, 2010

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2010-2758?

CVE-2010-2758 is considered a moderate vulnerability due to its potential to aid attackers in guessing product names.

How do I fix CVE-2010-2758?

To mitigate CVE-2010-2758, upgrade to a version of Bugzilla that is not affected, specifically newer than 3.6.1.

What products are affected by CVE-2010-2758?

CVE-2010-2758 affects Bugzilla versions from 2.17.1 to 3.6.1 and includes specific versions leading up to 3.7.2.

Which Bugzilla versions should be upgraded to avoid CVE-2010-2758?

You should upgrade to Bugzilla version 3.7.3 or later to avoid CVE-2010-2758.

What type of attacks does CVE-2010-2758 facilitate?

CVE-2010-2758 facilitates enumeration attacks, allowing remote attackers to discover product names.