CVE-2010-0180

Bugzilla 3.5.1-3.6 and 3.7 - Sensitive Configuration Exposure via World-Readable localconfig Files

Title source: llm
STIX 2.1

Description

Install/Filesystem.pm in Bugzilla 3.5.1 through 3.6 and 3.7, when use_suexec is enabled, uses world-readable permissions for the localconfig files, which allows local users to read sensitive configuration fields, as demonstrated by the database password field and the site_wide_secret field.

References (5)

Core 5
Core References
Vendor Advisory x_refsource_confirm
http://www.bugzilla.org/security/3.2.6/
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/40300
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/1595
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=561797
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/41144

Scores

EPSS 0.0024
EPSS Percentile 14.6%

Details

CWE
CWE-264
Status published
Products (5)
mozilla/bugzilla 3.5.1
mozilla/bugzilla 3.5.2
mozilla/bugzilla 3.5.3
mozilla/bugzilla 3.6
mozilla/bugzilla 3.7
Published Jun 28, 2010
Tracked Since Feb 18, 2026