CVE-2009-3166

{"id": "CVE-2009-3166", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-09-15T22:30:00.407", "references": [{"url": "http://secunia.com/advisories/36718", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.bugzilla.org/security/3.0.8/", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/36372", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id?1022902", "source": "cve@mitre.org"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=508189", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-255"}]}], "descriptions": [{"lang": "en", "value": "token.cgi in Bugzilla 3.4rc1 through 3.4.1 places a password in a URL at the beginning of a login session that occurs immediately after a password reset, which allows context-dependent attackers to discover passwords by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history."}, {"lang": "es", "value": "token.cgi en Bugzilla v3.4rc1 hasta v3.4.1 coloca una contrase\u00f1a en una URL al comienzo del inicio de sesi\u00f3n que ocurre inmediatamente despu\u00e9s del restablecimiento de la contrase\u00f1a, lo que permite dependiendo del contexto a atacantes descubrir contrase\u00f1as leyendo (1) logs de acceso del servidor web, (2) logs Referer del servidor web, o (3) el historial del navegador."}], "lastModified": "2009-09-19T05:32:17.063", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:bugzilla:3.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D6A71919-DC70-4AE2-9D16-76A177DAE331"}, {"criteria": "cpe:2.3:a:mozilla:bugzilla:3.4:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "780896D3-3B49-486F-A136-D3D175C00A34"}, {"criteria": "cpe:2.3:a:mozilla:bugzilla:3.4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EA43E47B-F474-4F5B-A91B-9AF99359FE5F"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}