Description
Bugzilla 2.17.1 through 2.18, 2.19.1, and 2.19.2, when a user is prompted to log in while attempting to view a chart, displays the password in the URL, which may allow local users to gain sensitive information from web logs or browser history.
References (7)
Core 7
Core References
Vendor Advisory vendor-advisory
x_refsource_conectiva
http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=001040
Mailing List mailing-list
x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=111592031902962&w=2
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2005/0533
Exploit, Patch, Vendor Advisory x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=287436
Exploit, Patch, Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/15338
Exploit, Patch, Vendor Advisory vdb-entry
x_refsource_osvdb
http://www.osvdb.org/16427
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/13605
Scores
EPSS
0.0122
EPSS Percentile
65.3%
Details
Status
published
Products (24)
mozilla/bugzilla
2.10
mozilla/bugzilla
2.12
mozilla/bugzilla
2.14
mozilla/bugzilla
2.14.1
mozilla/bugzilla
2.14.2
mozilla/bugzilla
2.14.3
mozilla/bugzilla
2.14.4
mozilla/bugzilla
2.14.5
mozilla/bugzilla
2.16
mozilla/bugzilla
2.16.1
... and 14 more
Published
May 12, 2005
Tracked Since
Feb 18, 2026