{"id":"CVE-2009-3989","aliases":["EUVD-2009-3960","GHSA-gvr3-v3rm-vjm4"],"status":"published","title":"Bugzilla before 3.0.11, 3.2.x before 3.2.6, 3.4.x before 3.4.5, and 3.5.x before 3.5.3 does not...","description":"Bugzilla before 3.0.11, 3.2.x before 3.2.6, 3.4.x before 3.4.5, and 3.5.x before 3.5.3 does not block access to files and directories that are used by custom installations, which allows remote attackers to obtain sensitive information via requests for (1) CVS/, (2) contrib/, (3) docs/en/xml/, (4) t/, or (5) old-params.txt.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01525,"percentile":0.74851,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-264"],"published":"2010-02-03T19:00:00Z","modified":"2026-06-16T23:12:46Z","products":[{"vendor":"mozilla","product":"bugzilla"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=314871","tags":["x_refsource_CONFIRM","x_transferred","Patch"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/56003","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=434801","tags":["x_refsource_CONFIRM","x_transferred","Patch"]},{"url":"http://www.vupen.com/english/advisories/2010/0261","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/38025","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/509282/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://secunia.com/advisories/38443","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-3989"},{"url":"https://github.com/advisories/GHSA-gvr3-v3rm-vjm4"}],"sources":{"cve":[{"id":"CVE-2009-3989","description":"Bugzilla before 3.0.11, 3.2.x before 3.2.6, 3.4.x before 3.4.5, and 3.5.x before 3.5.3 does not block access to files and directories that are used by custom installations, which allows remote attackers to obtain sensitive information via requests for (1) CVS/, (2) contrib/, (3) docs/en/xml/, (4) t/, or (5) old-params.txt.","status":"published","published":"2010-02-03T19:00:00Z","modified":"2024-08-07T06:45:50.966Z","updated_at":"2026-11-02T14:33:24.10565Z"}],"euvd":[{"id":"EUVD-2009-3960","description":"Bugzilla before 3.0.11, 3.2.x before 3.2.6, 3.4.x before 3.4.5, and 3.5.x before 3.5.3 does not block access to files and directories that are used by custom installations, which allows remote attackers to obtain sensitive information via requests for (1) CVS/, (2) contrib/, (3) docs/en/xml/, (4) t/, or (5) old-params.txt.","status":"published","published":"2010-02-03T19:00:00Z","modified":"2024-08-07T06:45:50Z","updated_at":"2026-11-03T01:39:11.734855Z"}],"ghsa":[{"id":"GHSA-gvr3-v3rm-vjm4","title":"Bugzilla before 3.0.11, 3.2.x before 3.2.6, 3.4.x before 3.4.5, and 3.5.x before 3.5.3 does not...","description":"Bugzilla before 3.0.11, 3.2.x before 3.2.6, 3.4.x before 3.4.5, and 3.5.x before 3.5.3 does not block access to files and directories that are used by custom installations, which allows remote attackers to obtain sensitive information via requests for (1) CVS/, (2) contrib/, (3) docs/en/xml/, (4) t/, or (5) old-params.txt.","status":"published","published":"2022-05-02T03:50:33Z","modified":"2023-01-31T05:09:21Z","updated_at":"2026-11-02T14:49:30.42259Z"}],"nvd":[{"id":"CVE-2009-3989","description":"Bugzilla before 3.0.11, 3.2.x before 3.2.6, 3.4.x before 3.4.5, and 3.5.x before 3.5.3 does not block access to files and directories that are used by custom installations, which allows remote attackers to obtain sensitive information via requests for (1) CVS/, (2) contrib/, (3) docs/en/xml/, (4) t/, or (5) old-params.txt.","status":"published","published":"2010-02-03T19:30:00.343Z","modified":"2026-06-16T23:12:46.97Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:01:38.33745Z"}]}}