CVE-2013-0786

medium

Published 2013-02-24 · Modified 2026-04-29

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS v4 NEW

—

not yet in upstream

VIR risk

5.0

Description

The Bugzilla::Search::build_subselect function in Bugzilla 2.x and 3.x before 3.6.13 and 3.7.x and 4.0.x before 4.0.10 generates different error messages for invalid product queries depending on whether a product exists, which allows remote attackers to discover private product names by using debug mode for a query.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Application impact

Vendor	Product	Versions
mozilla	bugzilla	`{"endIncluding":"3.6.12"}`
mozilla	bugzilla	`3.6`
mozilla	bugzilla	`3.6.0`
mozilla	bugzilla	`3.6.1`
mozilla	bugzilla	`3.6.2`
mozilla	bugzilla	`3.6.3`
mozilla	bugzilla	`3.6.4`
mozilla	bugzilla	`3.6.5`
mozilla	bugzilla	`3.6.6`
mozilla	bugzilla	`3.6.7`
mozilla	bugzilla	`3.6.8`
mozilla	bugzilla	`3.6.9`
mozilla	bugzilla	`3.6.10`
mozilla	bugzilla	`3.6.11`
mozilla	bugzilla	`3.7`
mozilla	bugzilla	`3.7.1`
mozilla	bugzilla	`3.7.2`
mozilla	bugzilla	`3.7.3`
mozilla	bugzilla	`4.0`
mozilla	bugzilla	`4.0.1`
mozilla	bugzilla	`4.0.2`
mozilla	bugzilla	`4.0.3`
mozilla	bugzilla	`4.0.4`
mozilla	bugzilla	`4.0.5`
mozilla	bugzilla	`4.0.6`
mozilla	bugzilla	`4.0.7`
mozilla	bugzilla	`4.0.8`
mozilla	bugzilla	`4.0.9`
mozilla	bugzilla	`2.0`
mozilla	bugzilla	`2.2`
mozilla	bugzilla	`2.4`
mozilla	bugzilla	`2.6`
mozilla	bugzilla	`2.8`
mozilla	bugzilla	`2.9`
mozilla	bugzilla	`2.10`
mozilla	bugzilla	`2.12`
mozilla	bugzilla	`2.14`
mozilla	bugzilla	`2.14.1`
mozilla	bugzilla	`2.14.2`
mozilla	bugzilla	`2.14.3`
mozilla	bugzilla	`2.14.4`
mozilla	bugzilla	`2.14.5`
mozilla	bugzilla	`2.16`
mozilla	bugzilla	`2.16.1`
mozilla	bugzilla	`2.16.2`
mozilla	bugzilla	`2.16.3`
mozilla	bugzilla	`2.16.4`
mozilla	bugzilla	`2.16.5`
mozilla	bugzilla	`2.16.6`
mozilla	bugzilla	`2.16.7`
mozilla	bugzilla	`2.16.8`
mozilla	bugzilla	`2.16.9`
mozilla	bugzilla	`2.16.10`
mozilla	bugzilla	`2.16.11`
mozilla	bugzilla	`2.17`
mozilla	bugzilla	`2.17.1`
mozilla	bugzilla	`2.17.2`
mozilla	bugzilla	`2.17.3`
mozilla	bugzilla	`2.17.4`
mozilla	bugzilla	`2.17.5`
mozilla	bugzilla	`2.17.6`
mozilla	bugzilla	`2.17.7`
mozilla	bugzilla	`2.18`
mozilla	bugzilla	`2.18.1`
mozilla	bugzilla	`2.18.2`
mozilla	bugzilla	`2.18.3`
mozilla	bugzilla	`2.18.4`
mozilla	bugzilla	`2.18.5`
mozilla	bugzilla	`2.18.6`
mozilla	bugzilla	`2.18.6\+`
mozilla	bugzilla	`2.18.7`
mozilla	bugzilla	`2.18.8`
mozilla	bugzilla	`2.18.9`
mozilla	bugzilla	`2.19`
mozilla	bugzilla	`2.19.1`
mozilla	bugzilla	`2.19.2`
mozilla	bugzilla	`2.19.3`
mozilla	bugzilla	`2.20`
mozilla	bugzilla	`2.20.1`
mozilla	bugzilla	`2.20.2`
mozilla	bugzilla	`2.20.3`
mozilla	bugzilla	`2.20.4`
mozilla	bugzilla	`2.20.5`
mozilla	bugzilla	`2.20.6`
mozilla	bugzilla	`2.20.7`
mozilla	bugzilla	`2.21`
mozilla	bugzilla	`2.21.1`
mozilla	bugzilla	`2.21.2`
mozilla	bugzilla	`2.22`
mozilla	bugzilla	`2.22.1`
mozilla	bugzilla	`2.22.2`
mozilla	bugzilla	`2.22.3`
mozilla	bugzilla	`2.22.4`
mozilla	bugzilla	`2.22.5`
mozilla	bugzilla	`2.22.6`
mozilla	bugzilla	`2.22.7`
mozilla	bugzilla	`2.23`
mozilla	bugzilla	`2.23.1`
mozilla	bugzilla	`2.23.2`
mozilla	bugzilla	`2.23.3`
mozilla	bugzilla	`2.23.4`

References

CWEs

CWE-200

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.