| Package | Affected versions | Patched versions |
|---|---|---|
| bugzilla | = 2.18= 2.18.1= 2.18.2= 2.18.3= 2.18.4= 2.18.5= 2.20= 2.20.1= 2.20.2= 2.22= 2.23= 2.23.1= 2.23.2 |
Bugzilla 2.18.x before 2.18.6, 2.20.x before 2.20.3, 2.22.x before 2.22.1, and 2.23.x before 2.23.3 allow remote attackers to obtain (1) the description of arbitrary attachments by viewing the attachment in "diff" mode in attachment.cgi, and (2) the deadline field by viewing the XML format of the bug in show_bug.cgi.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free