VulnerabilityModified
CVE-2011-2977
Bugzilla 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 on Windows does not delete the temporary files associated with uploaded attachments, which allows local users to obtain sensitive information by reading these files.
LOW 2.1EPSS 0.29%
Does this matter?
Lower severity and a low EPSS score (0.29%). Track it; it rarely justifies an emergency change on its own.
Description
Bugzilla 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 on Windows does not delete the temporary files associated with uploaded attachments, which allows local users to obtain sensitive information by reading these files. NOTE: this issue exists because of a regression in 3.6.
- CVSS 2.0
- 2.1 LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 0.29% probability · 21th percentile
- CISA KEV
- Not listed
- Affected
- mozilla/bugzilla
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/45501Vendor Advisory
- http://www.bugzilla.org/security/3.4.11/Vendor Advisory
- http://www.osvdb.org/74302
- http://www.securityfocus.com/bid/49042
- https://bugzilla.mozilla.org/show_bug.cgi?id=660502Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69037
- http://secunia.com/advisories/45501Vendor Advisory
- http://www.bugzilla.org/security/3.4.11/Vendor Advisory
- http://www.osvdb.org/74302
- http://www.securityfocus.com/bid/49042
- https://bugzilla.mozilla.org/show_bug.cgi?id=660502Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69037
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.