The Flag::validate and Flag::modify functions in Bugzilla 2.17.1 to 2.18.1 and 2.19.1 to 2.19.3 do not verify that the flag ID is appropriate for the given bug or attachment ID, which allows users to change flags on arbitrary bugs and obtain a bug summary via process_bug.cgi.

The remote host is affected by the vulnerability described in GLSA-200507-12 (Bugzilla: Unauthorized access and information disclosure)

    Bugzilla allows any user to modify the flags of any bug     (CAN-2005-2173). Bugzilla inserts bugs into the database before marking     them as private, in connection with MySQL replication this could lead     to a race condition (CAN-2005-2174).
  Impact :

    By manually changing the URL to process_bug.cgi, a remote attacker     could modify the flags of any given bug, which could trigger an email     including the bug summary to be sent to the attacker. The race     condition when using Bugzilla with MySQL replication could lead to a     short timespan (usually less than a second) where the summary of     private bugs is exposed to all users.
  Workaround :

    There are no known workarounds at this time.

A Bugzilla Security Advisory reports :

Any user can change any flag on any bug, even if they don't have access to that bug, or even if they can't normally make bug changes.
This also allows them to expose the summary of a bug.

Bugs are inserted into the database before they are marked as private, in Bugzilla code. Thus, MySQL replication can lag in between the time that the bug is inserted and when it is marked as private (usually less than a second). If replication lags at this point, the bug summary will be accessible to all users until replication catches up.
Also, on a very slow machine, there may be a pause longer than a second that allows users to see the title of the newly-filed bug.

The remote host is running Bugzilla, a bug-tracking software with a web interface.  This version of Bugzilla on the remote host suffers from two information disclosure vulnerabilities:

  - Any user can change any flag on a bug, even if they don't otherwise have access to the bug or rights to make changes to it.

 - A private bug summary may be visible to users if MySQL replication is used on the backend database.

According to its banner, the version of Bugzilla installed on the remote host reportedly allows any user to change any flag on a bug, even if they don't otherwise have access to the bug or rights to make changes to it. In addition, a private bug summary may be visible to users if MySQL replication is used on the backend database.

ID	Name	Product	Family	Severity
19199	GLSA-200507-12 : Bugzilla: Unauthorized access and information disclosure	Nessus	Gentoo Local Security Checks	medium
18976	FreeBSD : bugzilla -- multiple vulnerabilities (6e33f4ab-efed-11d9-8310-0001020eed82)	Nessus	FreeBSD Local Security Checks	medium
3060	Bugzilla < 2.18.2 / 2.20rc1 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
18654	Bugzilla <= 2.18.1 / 2.19.3 Multiple Vulnerabilities (ID, more)	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2005-2173

high

Tenable Plugins

medium

medium

medium

medium