Description
Bugzilla 2.10 through 2.18, 2.19.1, and 2.19.2 displays a different error message depending on whether a product exists or not, which allows remote attackers to determine hidden products.
References
- CLSA-2005:1040 vendor-advisory
- http://www.bugzilla.org/security/2.16.8/
- 20050512 Security Advisory for Bugzilla 2.18, 2.19.2, and 2.16.8 mailing-list
- ADV-2005-0533 vdb-entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=287109
- 13606 vdb-entry
- 15338 third-party-advisory
- 16425 vdb-entry