{"id":"CVE-2011-2380","aliases":["DSA-2322-1","EUVD-2011-2369","GHSA-f4x5-7cjq-vgcr"],"status":"published","title":"Bugzilla 2.23.3 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6...","description":"Bugzilla 2.23.3 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 allows remote attackers to determine the existence of private group names via a crafted parameter during (1) bug creation or (2) bug editing.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01766,"percentile":0.78233,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2011-08-09T19:00:00Z","modified":"2026-06-16T23:31:13Z","affected":[{"source":"osv","ecosystem":"Debian:6.0","package":"bugzilla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2.0-4.4"}]}],"versions":["3.6.2.0-4.2"],"bundled":10}],"products":[{"vendor":"mozilla","product":"bugzilla"}],"references":[{"url":"http://www.osvdb.org/74298","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://secunia.com/advisories/45501","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/69034","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://www.bugzilla.org/security/3.4.11/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=653477","tags":["x_refsource_CONFIRM","x_transferred","Patch"]},{"url":"http://www.osvdb.org/74299","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.debian.org/security/2011/dsa-2322","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.securityfocus.com/bid/49042","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2380"},{"url":"http://www.bugzilla.org/security/3.4.11"},{"url":"https://github.com/advisories/GHSA-f4x5-7cjq-vgcr"}],"sources":{"cve":[{"id":"CVE-2011-2380","description":"Bugzilla 2.23.3 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 allows remote attackers to determine the existence of private group names via a crafted parameter during (1) bug creation or (2) bug editing.","status":"published","published":"2011-08-09T19:00:00Z","modified":"2024-08-06T23:00:33.758Z","updated_at":"2026-11-02T14:35:36.603688Z"}],"euvd":[{"id":"EUVD-2011-2369","description":"Bugzilla 2.23.3 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 allows remote attackers to determine the existence of private group names via a crafted parameter during (1) bug creation or (2) bug editing.","status":"published","published":"2011-08-09T19:00:00Z","modified":"2024-08-06T23:00:33Z","updated_at":"2026-11-03T01:55:52.768318Z"}],"ghsa":[{"id":"GHSA-f4x5-7cjq-vgcr","title":"Bugzilla 2.23.3 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6...","description":"Bugzilla 2.23.3 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 allows remote attackers to determine the existence of private group names via a crafted parameter during (1) bug creation or (2) bug editing.","status":"published","published":"2022-05-17T01:55:20Z","modified":"2025-04-11T03:49:14Z","cwes":["CWE-200"],"updated_at":"2026-11-02T15:01:08.691526Z"}],"nvd":[{"id":"CVE-2011-2380","description":"Bugzilla 2.23.3 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 allows remote attackers to determine the existence of private group names via a crafted parameter during (1) bug creation or (2) bug editing.","status":"published","published":"2011-08-09T19:55:01.497Z","modified":"2026-06-16T23:31:13.89Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:02:09.182398Z"}],"osv":[{"id":"DSA-2322-1","title":"bugzilla - several","status":"published","published":"2011-10-10T00:00:00Z","modified":"2026-03-09T01:18:07.439974Z","updated_at":"2026-11-02T15:46:15.108335Z"}]}}