CVE-2003-0013 Information disclosure in n/a
Remote attackers can read database passwords by accessing unprotected backup files of the localconfig file in Bugzilla.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2003-0013?
CVE-2003-0013 is a high-severity vulnerability in Mozilla Bugzilla, published on 1 Sep 2004. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The default .htaccess scripts for Bugzilla 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 do not include filenames for backup copies of the localconfig file that are made from editors such as vi and Emacs, which could allow remote attackers to obtain a database password by directly accessing the backup file.
Which versions are affected by CVE-2003-0013?
It affects 1 product.
Products include Mozilla Bugzilla.
How do I fix CVE-2003-0013?
Upgrade to a fixed version.
Is CVE-2003-0013 being exploited?
There is no known exploitation of CVE-2003-0013 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Bugzilla
Sources
Also known as GHSA-q9qc-9wgg-p28f.