CVE-2012-4198 Information disclosure in n/a

What is CVE-2012-4198?

CVE-2012-4198 is a medium-severity vulnerability in Mozilla Bugzilla, published on 16 Nov 2012. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The User.get method in Bugzilla/WebService/User.pm in Bugzilla 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 has a different outcome for a groups request depending on whether a group exists, which allows remote authenticated users to discover private group names by observing whether a call throws an error.

Weakness: CWE-200

Which versions are affected by CVE-2012-4198?

It affects 1 product.

Products include Mozilla Bugzilla.

How do I fix CVE-2012-4198?

No fix has been published for CVE-2012-4198 yet. Limit exposure of the affected software until one is available.

Is CVE-2012-4198 being exploited?

There is no known exploitation of CVE-2012-4198 in the wild and no public exploit code.

Other vulnerabilities in Mozilla Bugzilla

• CVE-2004-0769 Memory corruption in n/a Critical 10.0
• CVE-2003-1042 SQL injection in n/a Critical 10.0
• CVE-2003-1043 SQL injection in n/a Critical 10.0
• CVE-2002-0007 Auth bypass in n/a Critical 10.0
• CVE-2018-5123 Cross-site request forgery in Bugzilla High 8.8

All Mozilla Bugzilla vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fcvv-97h9-vfw3.