CVE-2010-3764: Infoleak

Published Nov 5, 2010

Updated

The Old Charts implementation in Bugzilla 2.12 through 3.2.8, 3.4.8, 3.6.2, 3.7.3, and 4.1 creates graph files with predictable names in graphs/, which allows remote attackers to obtain sensitive information via a modified URL.

Affected Software

92 affected components

Bugzilla=2.18.6\+

Bugzilla=2.16.8

Bugzilla=2.22.7

Bugzilla=2.16_rc2

Bugzilla=2.18.8

Bugzilla=2.17.6

Bugzilla=2.16-rc2

Bugzilla=2.18.5

Bugzilla=2.19.3

Bugzilla=2.20-rc2

Bugzilla=2.18.6

Bugzilla=2.17.2

Bugzilla=2.20-rc1

Bugzilla=2.16.1

Bugzilla=2.20

Bugzilla=2.19

Bugzilla=2.18-rc1

Bugzilla=3.2.6

Bugzilla=2.16.2

Bugzilla=2.16.11

Bugzilla=3.2.5

Bugzilla=2.20.5

Bugzilla=2.20.6

Bugzilla=2.22.3

Bugzilla=2.22.6

Bugzilla=2.17.4

Bugzilla=2.16-rc1

Bugzilla=2.23.2

Bugzilla=2.21.2

Bugzilla=4.1

Bugzilla=2.17.1

Bugzilla=3.2.3

Bugzilla=2.16

Bugzilla=2.22.1

Bugzilla=2.23.4

Bugzilla=2.16.9

Bugzilla=2.20.1

Bugzilla=2.23.3

Bugzilla=2.14.2

Bugzilla=3.2.8

Bugzilla=2.18.7

Bugzilla=2.23.1

Bugzilla=2.22.2

Bugzilla=2.18.1

Bugzilla=2.22-rc1

Bugzilla=2.14.3

Bugzilla=2.22.5

Bugzilla=2.14.4

Bugzilla=3.4.8

Bugzilla=2.19.1

Bugzilla=2.16.7

Bugzilla=2.6

Bugzilla=2.17.5

Bugzilla=2.22

Bugzilla=2.17.3

Bugzilla=2.4

Bugzilla=2.16.4

Bugzilla=2.12

Bugzilla=2.20.3

Bugzilla=2.8

Bugzilla=3.2.4

Bugzilla=2.2

Bugzilla=3.7.3

Bugzilla=2.18.4

Bugzilla=3.2.2

Bugzilla=2.16.3

Bugzilla=2.14.5

Bugzilla=2.18.9

Bugzilla=2.18

Bugzilla=2.18.3

Bugzilla=2.17.7

Bugzilla=2.20.7

Bugzilla=2.20.2

Bugzilla=2.20.4

Bugzilla=2.21.1

Bugzilla=2.18-rc3

Bugzilla=2.17

Bugzilla=2.23

Bugzilla=2.16.6

Bugzilla=3.2.7

Bugzilla=2.9

Bugzilla=2.18.2

Bugzilla=2.18-rc2

Bugzilla=2.14.1

Bugzilla=2.22.4

Bugzilla=2.21

Bugzilla=3.2.1

Bugzilla=2.16.5

Bugzilla=3.6.2

Bugzilla=2.14

Bugzilla=2.19.2

Bugzilla=2.16.10

Remediation

Patch Available

https://bugzilla.mozilla.org/show_bug.cgi?id=419014

Event History

Nov 5, 2010

CVE Published

via MITRE·04:28 PM

Data Sourced

via MITRE·04:28 PM

Description

Frequently Asked Questions

What is the severity of CVE-2010-3764?

CVE-2010-3764 is classified as a moderate severity vulnerability due to its potential to expose sensitive information.

How do I fix CVE-2010-3764?

To remediate CVE-2010-3764, upgrade Bugzilla to a version prior to 3.2.8 or apply the appropriate patches provided by the vendor.

What versions of Bugzilla are affected by CVE-2010-3764?

CVE-2010-3764 affects Bugzilla versions 2.12 through 3.2.8, along with several other specific versions.

What type of vulnerability is CVE-2010-3764?

CVE-2010-3764 is a path traversal vulnerability that allows remote attackers to access sensitive graph files.

Can CVE-2010-3764 be exploited remotely?

Yes, CVE-2010-3764 can be exploited remotely if the attacker manipulates the URL to access sensitive graph files.