CVE-2005-3138: Mozilla Bugzilla

Medium severity, CVSS 5.0. EPSS: 1.1% chance of exploitation in the next 30 days.

Bugzilla 2.18rc1 through 2.18.3, 2.19 through 2.20rc2, and 2.21 allows remote attackers to obtain sensitive information such as the list of installed products via the config.cgi file, which is accessible even when the requirelogin parameter is set.

Affected products

• Mozilla Bugzilla: version 2.18 only; version 2.18.1 only; version 2.18.2 only; version 2.18.3 only; version 2.19 only; version 2.19.1 only; …

Published 2005-10-05. Last modified 2026-06-16.