CVE-2007-0792 — Mozilla Bugzilla vulnerability

3 documents3 sources
Severity
7.5HIGHNVD
EPSS
1.0%
top 23.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Mozilla Bugzilla
Timeline
PublishedFeb 6
Latest updateMay 1

Description

The mod_perl initialization script in Bugzilla 2.23.3 does not set the Bugzilla Apache configuration to allow .htaccess permissions to override file permissions, which allows remote attackers to obtain the database username and password via a direct request for the localconfig file.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages1 packages

▶NVDmozilla/bugzilla2.23.3

🔴Vulnerability Details

2
GHSA
GHSA-mgxx-f3xq-rch5: The mod_perl initialization script in Bugzilla 2↗2022-05-01
▶
CVEList
CVE-2007-0792: The mod_perl initialization script in Bugzilla 2↗2007-02-06
▶
CVE-2007-0792 — Mozilla Bugzilla vulnerability | cvebase