CVE-2007-0792 json
The mod_perl initialization script in Bugzilla 2.23.3 does not set the Bugzilla Apache configuration to allow .htaccess permissions to over…
published 2007-02-06 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-0789
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.4%
- EPSS 1.4% chance of exploitation in 30 days, percentile 72%
- public exploits
- 0
- none known
Summary
The mod_perl initialization script in Bugzilla 2.23.3 does not set the Bugzilla Apache configuration to allow .htaccess permissions to override file permissions, which allows remote attackers to obtain the database username and password via a direct request for the localconfig file.
Exploit prediction
1.38% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
-
bugzilla.org
/security/2.20.3/
vendor-advisory
-
osvdb.org
/35862
vdb-entry
-
securityreason.com
/securityalert/2222
third-party-advisory
-
securityfocus.com
/bid/22380
vdb-entry
-
securitytracker.com
/id?1017585
vdb-entry
-
securityfocus.com
/archive/1/459025/100/0/threaded
mailing-list
-
vupen.com
/english/advisories/2007/0477
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/32252
vdb-entry
Sources
- CVE List CVE-2007-0792
- NVD CVE-2007-0792
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.