CVE-2005-1565 Information disclosure in n/a

Medium 5.0 Published 14 May 2005 Updated 7 Aug 2024

Bugzilla exposes user passwords in URLs during chart access, allowing local attackers to steal credentials from logs or history.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2005-1565?

CVE-2005-1565 is a medium-severity vulnerability in Mozilla Bugzilla, published on 14 May 2005. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Bugzilla 2.17.1 through 2.18, 2.19.1, and 2.19.2, when a user is prompted to log in while attempting to view a chart, displays the password in the URL, which may allow local users to gain sensitive information from web logs or browser history.

Which versions are affected by CVE-2005-1565?

It affects 1 product.

Products include Mozilla Bugzilla.

How do I fix CVE-2005-1565?

No fix has been published for CVE-2005-1565 yet. Limit exposure of the affected software until one is available.

Is CVE-2005-1565 being exploited?

There is no known exploitation of CVE-2005-1565 in the wild and no public exploit code.

All Mozilla Bugzilla vulnerabilities

Sources

Also known as GHSA-3wxw-p7xf-3r35.