Description
Bugzilla 3.3.1 through 3.4.4, 3.5.1, and 3.5.2 does not allow group restrictions to be preserved throughout the process of moving a bug to a different product category, which allows remote attackers to obtain sensitive information via a request for a bug in opportunistic circumstances.
References
- bugzilla-group-restriction-info-disclosure(56004) vdb-entry
- ADV-2010-0261 vdb-entry
- 20100201 Security Advisory for Bugzilla 3.0.10, 3.2.5, 3.4.4, and 3.5.2 mailing-list
- https://bugzilla.mozilla.org/show_bug.cgi?id=532493
- 38443 third-party-advisory
- 38026 vdb-entry