4
CVE-2014-1571
- EPSS 1.35%
- Veröffentlicht 13.10.2014 01:55:05
- Zuletzt bearbeitet 06.05.2026 22:30:45
- Erkennungen
LoginBugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 allows remote authenticated users to obtain sensitive private-comment information by leveraging a role as a flag recipient, related to Bug.pm, Flag.pm, and a mail template.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fedoraproject ≫ Fedora Version 19
Fedoraproject ≫ Fedora Version 20
Fedoraproject ≫ Fedora Version 21
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.35% | 0.679 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 4 | 8 | 2.9 |
AV:N/AC:L/Au:S/C:P/I:N/A:N
|
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
http://advisories.mageia.org/MGASA-2014-0412.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-November/142524.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141309.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141321.html
http://packetstormsecurity.com/files/128578/Bugzilla-Account-Creation-XSS-Information-Leak.html
http://www.bugzilla.org/security/4.0.14/
http://www.mandriva.com/security/advisories?name=MDVSA-2014:200
http://www.securitytracker.com/id/1030978
https://bugzilla.mozilla.org/show_bug.cgi?id=1064140