Vulnerability Description
Install/Filesystem.pm in Bugzilla 3.5.1 through 3.6.1 and 3.7 through 3.7.1, when use_suexec is enabled, uses world-readable permissions within (1) .bzr/ and (2) data/webdot/, which allows local users to obtain potentially sensitive data by reading files in these directories, a different vulnerability than CVE-2010-0180.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Bugzilla | 3.5.1 |
Related Weaknesses (CWE)
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=561797Patch
- https://bugzilla.mozilla.org/show_bug.cgi?id=561797Patch
FAQ
What is CVE-2010-2470?
CVE-2010-2470 is a vulnerability with a CVSS score of 1.9 (LOW). Install/Filesystem.pm in Bugzilla 3.5.1 through 3.6.1 and 3.7 through 3.7.1, when use_suexec is enabled, uses world-readable permissions within (1) .bzr/ and (2) data/webdot/, which allows local users...
How severe is CVE-2010-2470?
CVE-2010-2470 has been rated LOW with a CVSS base score of 1.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2010-2470?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Bugzilla.