Description
The Old Charts implementation in Bugzilla 2.12 through 3.2.8, 3.4.8, 3.6.2, 3.7.3, and 4.1 creates graph files with predictable names in graphs/, which allows remote attackers to obtain sensitive information via a modified URL.
References
- FEDORA-2010-17280 vendor-advisory
- bugzilla-graphs-info-disclosure(62969) vdb-entry
- ADV-2010-2878 vdb-entry
- http://www.bugzilla.org/security/3.2.8/
- FEDORA-2010-17274 vendor-advisory
- 1024683 vdb-entry
- FEDORA-2010-17235 vendor-advisory
- ADV-2010-2975 vdb-entry
- 42271 third-party-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=419014