CVE-2009-3387
Bugzilla 3.3.1 through 3.4.4, 3.5.1, and 3.5.2 does not allow group restrictions to be preserved...
Bugzilla 3.3.1 through 3.4.4, 3.5.1, and 3.5.2 does not allow group restrictions to be preserved throughout the process of moving a bug to a different product category, which allows remote attackers to obtain sensitive information via a request for a bug in opportunistic circumstances.
Exploit likelihood
What each source reports
NVD Score used
Bugzilla 3.3.1 through 3.4.4, 3.5.1, and 3.5.2 does not allow group restrictions to be preserved throughout the process of moving a bug to a different product category, which allows remote attackers to obtain sensitive information via a request for a bug in opportunistic circumstances.
- Record
CVE-2009-3387- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Bugzilla 3.3.1 through 3.4.4, 3.5.1, and 3.5.2 does not allow group restrictions to be preserved throughout the process of moving a bug to a different product category, which allows remote attackers to obtain sensitive information via a request for a bug in opportunistic circumstances.
- Record
CVE-2009-3387- Updated
- 2026-11-02
EUVDEUVD-2009-3369 No score
Bugzilla 3.3.1 through 3.4.4, 3.5.1, and 3.5.2 does not allow group restrictions to be preserved throughout the process of moving a bug to a different product category, which allows remote attackers to obtain sensitive information via a request for a bug in opportunistic circumstances.
- Record
EUVD-2009-3369- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-24h9-wwcg-r638 No score
Bugzilla 3.3.1 through 3.4.4, 3.5.1, and 3.5.2 does not allow group restrictions to be preserved...
Bugzilla 3.3.1 through 3.4.4, 3.5.1, and 3.5.2 does not allow group restrictions to be preserved throughout the process of moving a bug to a different product category, which allows remote attackers to obtain sensitive information via a request for a bug in opportunistic circumstances.
- Record
GHSA-24h9-wwcg-r638- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-3387 is a medium vulnerability (CVSS 5.0) in Mozilla Bugzilla, published February 3, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.73%, the 77th percentile. No source names a fixed version.
References
exchange.xforce.ibmcloud.com/vulnerabilities/56004
vupen.com/english/advisories/2010/0261
securityfocus.com/archive/1/509282/100/0/threaded
bugzilla.mozilla.org/show_bug.cgi?id=532493
secunia.com/advisories/38443
nvd.nist.gov/vuln/detail/CVE-2009-3387
github.com/advisories/GHSA-24h9-wwcg-r638