CVE-2004-1635 json
Bugzilla 2.17.1 through 2.18rc2 and 2.19 from cvs, when using the insidergroup feature, does not sufficiently protect private attachments w…
published 2004-10-24 22 y ago modified 2026-06-16 4 mo ago also EUVD-2004-1629
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.4%
- EPSS 1.4% chance of exploitation in 30 days, percentile 73%
- public exploits
- 0
- none known
Summary
Bugzilla 2.17.1 through 2.18rc2 and 2.19 from cvs, when using the insidergroup feature, does not sufficiently protect private attachments when there are changes to the metadata, such as filename, description, MIME type, or review flags, which allows remote authenticated users to obtain sensitive information when (1) viewing the bug activity log or (2) receiving bug change notification mails.
Patch / fix
- securityfocus.com/bid/11511 advisory
Exploit prediction
1.43% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
References
-
securityfocus.com
/bid/11511
vdb-entry, patch, vendor-advisory
-
bugzilla.mozilla.org
/show_bug.cgi?id=253544
vendor-advisory
-
bugzilla.mozilla.org
/show_bug.cgi?id=250605
vendor-advisory
-
marc.info
/?l=bugtraq&m=109872095201238&w=2
mailing-list
-
exchange.xforce.ibmcloud.com
/vulnerabilities/17842
vdb-entry
Sources
- CVE List CVE-2004-1635
- NVD CVE-2004-1635
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.