CVE-2009-3989

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-02-03 · updated 2026-06-16
Weakness: CWE-264

Description

Bugzilla before 3.0.11, 3.2.x before 3.2.6, 3.4.x before 3.4.5, and 3.5.x before 3.5.3 does not block access to files and directories that are used by custom installations, which allows remote attackers to obtain sensitive information via requests for (1) CVS/, (2) contrib/, (3) docs/en/xml/, (4) t/, or (5) old-params.txt.

Affected products

Mozilla Bugzilla: through 3.0.10; 2.0, 2.2, 2.4, 2.6, 2.8, 2.10 (+78)

References

http://secunia.com/advisories/38443
http://www.securityfocus.com/archive/1/509282/100/0/threaded
http://www.securityfocus.com/bid/38025
http://www.vupen.com/english/advisories/2010/0261
https://bugzilla.mozilla.org/show_bug.cgi?id=314871
https://bugzilla.mozilla.org/show_bug.cgi?id=434801
https://exchange.xforce.ibmcloud.com/vulnerabilities/56003
http://secunia.com/advisories/38443
http://www.securityfocus.com/archive/1/509282/100/0/threaded
http://www.securityfocus.com/bid/38025
http://www.vupen.com/english/advisories/2010/0261
https://bugzilla.mozilla.org/show_bug.cgi?id=314871

Get alerted when CVE-2009-3989 or the next vulnerability affects your stack