CVE-2012-1968 in Bugzilla
Summary
Bugzilla 4.1.x and 4.2.x before 4.2.2 and 4.3.x before 4.3.2 uses bug-editor privileges instead of bugmail-recipient privileges during construction of HTML bugmail documents, which allows remote attackers to obtain sensitive description information by reading the tooltip portions of an HTML e-mail message.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Reservation
03/30/2012
Disclosure
07/30/2012
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 5878 | Mozilla Bugzilla access control | 264 | Proof-of-Concept | Official fix | CVE-2012-1968 |