CVE-2012-1969: Medium severity bugzilla vulnerability
The getattachmentlink function in Template.pm in Bugzilla 2.x and 3.x before 3.6.10, 3.7.x and 4.0.x before 4.0.7, 4.1.x and 4.2.x before 4.2.2, and 4.3.x before 4.3.2 does not check whether an attachment is private before presenting the attachment description within a public comment, which allows remote attackers to obtain sensitive description information by reading a comment.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-1969?
The severity of CVE-2012-1969 is classified as a Medium risk, as it involves the exposure of private attachment descriptions in public comments.
How do I fix CVE-2012-1969?
To fix CVE-2012-1969, update your Bugzilla installation to version 3.6.10, 3.7.4, 4.0.7, 4.2.2, or 4.3.2 or later.
What versions of Bugzilla are affected by CVE-2012-1969?
CVE-2012-1969 affects Bugzilla versions 2.x and 3.x prior to 3.6.10, 3.7.x prior to 4.0.7, and 4.1.x and 4.2.x prior to 4.2.2.
What kind of attack can exploit CVE-2012-1969?
CVE-2012-1969 can be exploited to disclose private information within public comments, potentially exposing sensitive attachment descriptions.
Is there a workaround for CVE-2012-1969?
There is no official workaround for CVE-2012-1969 other than upgrading to a patched version of Bugzilla.