Login Request a demo
Unscored severity · published Oct 13, 2014
CVE-2014-1571
Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 allows remote authenticated users to obtain sensitive…
–
CVSS
1.4%
EPSS
No
On KEV
Description
Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 allows remote authenticated users to obtain sensitive private-comment information by leveraging a role as a flag recipient, related to Bug.pm, Flag.pm, and a mail template.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BU
Bugzilla · Mozilla
2.0; 2.2; 2.4; 2.6; 2.8; 2.9; +34 more · source: NVD
FE
Fedora · Fedoraproject
19; 20; 21 · source: NVD
Affected product
FE
Fedora
Fedoraproject
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-1571
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-1571
advisories.mageia.org
http://advisories.mageia.org/MGASA-2014-0412.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2014-November/142524.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141309.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141321.html
packetstormsecurity.com
http://packetstormsecurity.com/files/128578/Bugzilla-Account-Creation-XSS-Information-Leak.html
Vendor Advisory
http://www.bugzilla.org/security/4.0.14/
More from Fedora
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
10.0
CVE-2015-3306
ProFTPD Improper Access Control Vulnerability
9.8
CVE-2024-4577
Argument Injection in PHP-CGI
9.8
CVE-2021-44026
Roundcube Webmail SQL Injection Vulnerability
9.8
CVE-2021-42013
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)