VULNERABILITY INTELLIGENCE

CVE-2009-3989

CVSS score4.3 MEDIUM
EPSS probability1.52%
CISA KEVNot currently listed
Published2010-02-03
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:P/I:N/A:N

Description

Bugzilla before 3.0.11, 3.2.x before 3.2.6, 3.4.x before 3.4.5, and 3.5.x before 3.5.3 does not block access to files and directories that are used by custom installations, which allows remote attackers to obtain sensitive information via requests for (1) CVS/, (2) contrib/, (3) docs/en/xml/, (4) t/, or (5) old-params.txt.

Primary references