CVE-2018-5123

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-04-29 · updated 2026-06-17
Weakness: CWE-352

Description

A third party website can access information available to a user with access to a restricted bug entry using the image generation in report.cgi in all Bugzilla versions prior to 4.4.

Affected products

Mozilla Bugzilla: before 4.4 — fixed in 4.4

How to fix

Upgrade to a fixed version: Mozilla Bugzilla 4.4. Check the vendor advisory for mitigations.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2018-5123
https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2018-5123

Get alerted when CVE-2018-5123 or the next vulnerability affects your stack