CVE-2007-0792 Information disclosure in n/a
Remote attackers can read database credentials from the localconfig file due to missing Apache configuration overrides in Bugzilla.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2007-0792?
CVE-2007-0792 is a high-severity vulnerability in Mozilla Bugzilla, published on 6 Feb 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The mod_perl initialization script in Bugzilla 2.23.3 does not set the Bugzilla Apache configuration to allow .htaccess permissions to override file permissions, which allows remote attackers to obtain the database username and password via a direct request for the localconfig file.
Which versions are affected by CVE-2007-0792?
It affects 1 product.
Products include Mozilla Bugzilla.
How do I fix CVE-2007-0792?
No fix has been published for CVE-2007-0792 yet. Limit exposure of the affected software until one is available.
Is CVE-2007-0792 being exploited?
There is no known exploitation of CVE-2007-0792 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Bugzilla
Sources
Also known as GHSA-mgxx-f3xq-rch5.