Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Bugzilla may leak private comments when exporting to XML

CVE-2004-1634 · published 22 years ago
Summary

Bugzilla versions 2.17.1 through 2.18rc2 and 2.19 can include private comments and attachment summaries in XML export files if the insidergroup feature is used. This could let someone who obtains the exported file see information that should stay hidden. Apply the vendor's update or disable the insidergroup feature and avoid exporting sensitive bugs until the fix is installed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
mozilla bugzilla 2.4
2.6
2.8
2.10
2.12
2.14
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.16
13 more version ranges
cpe:2.3:a:mozilla:bugzilla:2.4:*:*:*:*:*:*:*
Original advisory text
show_bug.cgi in Bugzilla 2.17.1 through 2.18rc2 and 2.19 from CVS, when using the insidergroup feature and exporting a bug to XML, shows comments and attachment summaries which are marked as privat...
show_bug.cgi in Bugzilla 2.17.1 through 2.18rc2 and 2.19 from CVS, when using the insidergroup feature and exporting a bug to XML, shows comments and attachment summaries which are marked as private, which allows remote attackers to gain sensitive information.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
1% chance of attack within 30 days
Timeline
Published25 Oct 2004
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2004-1634 · NVD
Track software like this
Free during beta