CVE-2012-4198 in Bugzilla
Summary
The User.get method in Bugzilla/WebService/User.pm in Bugzilla 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 has a different outcome for a groups request depending on whether a group exists, which allows remote authenticated users to discover private group names by observing whether a call throws an error.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Reservation
08/08/2012
Disclosure
11/16/2012
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 6937 | Bugzilla User.get information disclosure | 200 | Proof-of-Concept | Official fix | CVE-2012-4198 |