Description
The mod_perl initialization script in Bugzilla 2.23.3 does not set the Bugzilla Apache configuration to allow .htaccess permissions to override file permissions, which allows remote attackers to obtain the database username and password via a direct request for the localconfig file.
References
- 35862 vdb-entry
- 2222 third-party-advisory
- 22380 vdb-entry
- 1017585 vdb-entry
- 20070203 Security Advisory for Bugzilla 2.20.3, 2.22.1, and 2.23.3 mailing-list
- http://www.bugzilla.org/security/2.20.3/
- ADV-2007-0477 vdb-entry
- bugzilla-htaccess-information-disclosure(32252) vdb-entry