Description
Bugzilla 2.19.1 through 2.20rc2 and 2.21, with user matching turned on in substring mode, allows attackers to list all users whose names match an arbitrary substring, even when the usevisibilitygroups parameter is set.
References (5)
Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/42799
Patch, Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/17030/
Patch vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/14996
Patch, Vendor Advisory x_refsource_confirm
http://www.bugzilla.org/security/2.18.4/
Mailing List mailing-list
x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=112818466125484&w=2
Scores
EPSS
0.0097
EPSS Percentile
58.2%
Details
Status
published
Products (5)
mozilla/bugzilla
2.19.1
mozilla/bugzilla
2.19.2
mozilla/bugzilla
2.19.3
mozilla/bugzilla
2.20 rc1 (2 CPE variants)
mozilla/bugzilla
2.21
Published
Oct 05, 2005
Tracked Since
Feb 18, 2026