CVE-2012-1968

Bugzilla 4.1.x and 4.2.x before 4.2.2 and 4.3.x before 4.3.2 uses bug-editor privileges instead of bugmail-recipient privileges during construction of HTML bugmail documents, which allows remote attackers to obtain sensitive description information by reading the tooltip portions of an HTML e-mail message.

Score

CVSS 2.0 4.3 Medium

Status

Modified - cve@mitre.org

Published

2012-07-30

Last modified

2024-09-16

Weaknesses

CWE-264

Affected products

• Bugzilla (Mozilla)

References

• http://secunia.com/advisories/50040
• http://www.bugzilla.org/security/3.6.9/
• https://bugzilla.mozilla.org/show_bug.cgi?id=777398