CVE-2011-2380: Infoleak

Published Aug 9, 2011

Updated

Bugzilla 2.23.3 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 allows remote attackers to determine the existence of private group names via a crafted parameter during (1) bug creation or (2) bug editing.

Affected Software

75 affected components

Bugzilla=2.22.7

Bugzilla=2.23.2

Bugzilla=2.23.3

Bugzilla=2.23.1

Bugzilla=2.23

Bugzilla=3.4.3

Bugzilla=3.4.2

Bugzilla=3.4.9

Bugzilla=3.4.1

Bugzilla=3.4.10

Bugzilla=3.4.4

Bugzilla=3.4.8

Bugzilla=3.4.7

Bugzilla=3.4.11

Bugzilla=3.4

Bugzilla=3.4.5

Bugzilla=3.4-rc1

Bugzilla=3.4.6

Bugzilla=3.5.3

Bugzilla=3.5.2

Bugzilla=3.5.1

Bugzilla=3.5

Bugzilla=3.6.1

Bugzilla=3.6.0

Bugzilla=3.6.3

Bugzilla=3.6

Bugzilla=3.6.4

Bugzilla=3.6-rc1

Bugzilla=3.6.5

Bugzilla=3.6.2

Bugzilla=3.7.2

Bugzilla=3.7.1

Bugzilla=3.7

Bugzilla=3.7.3

Bugzilla=4.0.1

Bugzilla=4.0-rc2

Bugzilla=4.0-rc1

Bugzilla=4.0

Bugzilla=4.1.1

Bugzilla=4.1

Bugzilla=4.1.2

Bugzilla=3.0.4

Bugzilla=3.0-rc1

Bugzilla=3.1.3

Bugzilla=3.0.0

Bugzilla=3.3.2

Bugzilla=3.0.1

Bugzilla=3.2-rc1

Bugzilla=3.2.6

Bugzilla=3.1.1

Bugzilla=3.1.2

Bugzilla=3.2.5

Bugzilla=3.3.4

Bugzilla=3.2.9

Bugzilla=3.2.10

Bugzilla=3.2.3

Bugzilla=3.0.11

Bugzilla=3.0.6

Bugzilla=3.0.7

Bugzilla=3.2.8

Bugzilla=3.1.4

Bugzilla=3.1.0

Bugzilla=3.0.3

Bugzilla=3.0.9

Bugzilla=3.2.4

Bugzilla=3.0.2

Bugzilla=3.3.3

Bugzilla=3.2.2

Bugzilla=3.0.10

Bugzilla=3.0.8

Bugzilla=3.2.7

Bugzilla=3.2-rc2

Bugzilla=3.0.5

Bugzilla=3.2.1

Bugzilla=3.3.1

Remediation

Patch Available

https://bugzilla.mozilla.org/show_bug.cgi?id=653477

Event History

Aug 9, 2011

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2011-2380?

CVE-2011-2380 has been classified with moderate severity due to its potential exploitation by remote attackers.

How do I fix CVE-2011-2380?

To address CVE-2011-2380, update Bugzilla to version 4.1.3 or later.

Which versions of Bugzilla are affected by CVE-2011-2380?

CVE-2011-2380 affects Bugzilla versions from 2.22.7 up to 4.0.x before 4.0.2, and 4.1.x before 4.1.3.

What types of attacks does CVE-2011-2380 allow?

CVE-2011-2380 allows remote attackers to determine the existence of private group names during bug creation or editing.

Is there a known fix for CVE-2011-2380?

Yes, the known fix for CVE-2011-2380 is to upgrade to the fixed versions of Bugzilla.