Description
Bugzilla before 3.0.11, 3.2.x before 3.2.6, 3.4.x before 3.4.5, and 3.5.x before 3.5.3 does not block access to files and directories that are used by custom installations, which allows remote attackers to obtain sensitive information via requests for (1) CVS/, (2) contrib/, (3) docs/en/xml/, (4) t/, or (5) old-params.txt.
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=314871
- bugzilla-files-info-disclosure(56003) vdb-entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=434801
- ADV-2010-0261 vdb-entry
- 38025 vdb-entry
- 20100201 Security Advisory for Bugzilla 3.0.10, 3.2.5, 3.4.4, and 3.5.2 mailing-list
- 38443 third-party-advisory