CVE-2005-3139: Mozilla Bugzilla

Medium severity, CVSS 5.0. EPSS: 1% chance of exploitation in the next 30 days.

Bugzilla 2.19.1 through 2.20rc2 and 2.21, with user matching turned on in substring mode, allows attackers to list all users whose names match an arbitrary substring, even when the usevisibilitygroups parameter is set.

Affected products

• Mozilla Bugzilla: version 2.19.1 only; version 2.19.2 only; version 2.19.3 only; version 2.20 only; version 2.21 only

Published 2005-10-05. Last modified 2026-06-16.