CVE-2004-1634: Mozilla Bugzilla

Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days.

show_bug.cgi in Bugzilla 2.17.1 through 2.18rc2 and 2.19 from CVS, when using the insidergroup feature and exporting a bug to XML, shows comments and attachment summaries which are marked as private, which allows remote attackers to gain sensitive information.

Affected products

• Mozilla Bugzilla: version 2.4 only; version 2.6 only; version 2.8 only; version 2.10 only; version 2.12 only; version 2.14 only; …

Published 2004-10-25. Last modified 2026-06-16.