CVE-2007-0792
HIGH severity · CVSS 7.5
7.5CVSS HIGH
Summary
The mod_perl initialization script in Bugzilla 2.23.3 does not set the Bugzilla Apache configuration to allow .htaccess permissions to override file permissions, which allows remote attackers to obtain the database username and password via a direct request for the localconfig file.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges required—
User interaction—
Confidentiality impact—
Integrity impact—
Availability impact—
Exploit probability (EPSS)1%
AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected products we track (1)
Recommendation
Apply the vendor fix promptly. Open any affected product above for its exact safe version.
Additional information
- NVD record
- http://www.bugzilla.org/security/2.20.3/Advisory
- http://osvdb.org/35862
- http://securityreason.com/securityalert/2222
- http://securitytracker.com/id?1017585
- http://www.securityfocus.com/archive/1/459025/100/0/threaded
- http://www.securityfocus.com/bid/22380
- http://www.vupen.com/english/advisories/2007/0477
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32252