Description
Bugzilla 2.17.1 through 2.18, 2.19.1, and 2.19.2, when a user is prompted to log in while attempting to view a chart, displays the password in the URL, which may allow local users to gain sensitive information from web logs or browser history.
References
- CLSA-2005:1040 vendor-advisory
- 20050512 Security Advisory for Bugzilla 2.18, 2.19.2, and 2.16.8 mailing-list
- ADV-2005-0533 vdb-entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=287436
- 15338 third-party-advisory
- 16427 vdb-entry
- 13605 vdb-entry