CVE-2014-1571

Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4...

4.0 MediumFix available

CVE-2014-1571 is a medium vulnerability (CVSS 4.0) in Mozilla Bugzilla, published October 9, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.35%, the 71st percentile. Fixed in bugzilla 4.4.6-1.mga3.

Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 allows remote authenticated users to obtain sensitive private-comment information by leveraging a role as a flag recipient, related to Bug.pm, Flag.pm, and a mail template.

Exploit likelihood

1.35%Down 0.3 points since Feb 4, 2022

What each source reports

NVD Score used 4.0

Record: CVE-2014-1571
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-1571
Updated: 2026-11-02

EUVDEUVD-2014-1647 No score

Record: EUVD-2014-1647
Updated: 2026-11-03

GitHub AdvisoriesGHSA-rcrm-4q59-vjfh No score

Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4...

Record: GHSA-rcrm-4q59-vjfh
Weakness: CWE-200
Updated: 2026-11-02

OSVMGASA-2014-0412 No score

Updated bugzilla packages fix security vulnerabilities

Updated bugzilla packages fix security vulnerabilities:

If a new comment was marked private to the insider group, and a flag was set in the same transaction, the comment would be visible to flag recipients even if they were not in the insider group (CVE-2014-1571).

An attacker creating a new Bugzilla account can override certain parameters when finalizing the account creation that can lead to the user being created with a different email address than originally requested. The overridden login name could be automatically added to groups based on the group's regular expression setting (CVE-2014-1572).

During an audit of the Bugzilla code base, several places were found where cross-site scripting exploits could occur which could allow an attacker to access sensitive information (CVE-2014-1573).

Record: MGASA-2014-0412
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10664-1 No score

bugzilla-5.0.6-4.2 on GA media

These are all security issues fixed in the bugzilla-5.0.6-4.2 package on the GA media of openSUSE Tumbleweed.