CVE

Id
27896  
CVE No.
CVE-2007-4539  
Status
Candidate  
Description
The WebService (XML-RPC) interface in Bugzilla 2.23.3 through 3.0.0 does not enforce permissions for the time-tracking fields of bugs, which allows remote attackers to obtain sensitive information via certain XML-RPC requests, as demonstrated by the (1) Deadline and (2) Estimated Time fields.  
Phase
Assigned (20070827)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
287758 27896 CVE-2007-4539 BUGTRAQ:20070823 Security Advisory for Bugzilla 3.0, 2.22.1, and 2.20.4  View
287759 27896 CVE-2007-4539 URL:http://www.securityfocus.com/archive/1/archive/1/477630/100/0/threaded  View
287760 27896 CVE-2007-4539 MISC:https://bugzilla.mozilla.org/show_bug.cgi?id=382056  View
287761 27896 CVE-2007-4539 CONFIRM:http://www.bugzilla.org/security/2.20.4/  View
287762 27896 CVE-2007-4539 GENTOO:GLSA-200709-18  View
287763 27896 CVE-2007-4539 URL:http://security.gentoo.org/glsa/glsa-200709-18.xml  View
287764 27896 CVE-2007-4539 BID:25425  View
287765 27896 CVE-2007-4539 URL:http://www.securityfocus.com/bid/25425  View
287766 27896 CVE-2007-4539 VUPEN:ADV-2007-2977  View
287767 27896 CVE-2007-4539 URL:http://www.vupen.com/english/advisories/2007/2977  View
287768 27896 CVE-2007-4539 OSVDB:37202  View
287769 27896 CVE-2007-4539 URL:http://osvdb.org/37202  View
287770 27896 CVE-2007-4539 SECTRACK:1018604  View
287771 27896 CVE-2007-4539 URL:http://www.securitytracker.com/id?1018604  View
287772 27896 CVE-2007-4539 SECUNIA:26584  View
287773 27896 CVE-2007-4539 URL:http://secunia.com/advisories/26584  View
287774 27896 CVE-2007-4539 SECUNIA:26971  View
287775 27896 CVE-2007-4539 URL:http://secunia.com/advisories/26971  View
287776 27896 CVE-2007-4539 XF:bugzilla-xmlrpc-information-disclosure(36244)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
55641 JVNDB-2007-004333 od におけるクロスサイトスクリプティングの脆弱性 Olate Download (od) には、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2007-4541 27896 4.3 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-004333.html  View