IDOR To information disclosure
Categories
(bugzilla.mozilla.org :: General, defect)
Tracking
()
People
(Reporter: mdovi303, Unassigned)
Details
Attachments
(2 files)
Screenshot.png
User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/83.0.4103.61 Chrome/83.0.4103.61 Safari/537.36
Steps to reproduce:
1st:
Login to "https://bugzilla.mozilla.org"
2nd:
Then go to "my profile" from Account option then you will see url like this "https://bugzilla.mozilla.org/user_profile?user_id=667143"
3rd:
Then change the "user_id=" parameter like this :667142,667140 etc etc. i mean increase and decrease "user_id=" parameter value.
4th:
You will see other users email address will disclosure in page search box
Actual results:
You will see other users email address will disclosure in page search box
Expected results:
An attacker can enumerate other user email address and this bug allow to extract all registered email .
|
||
Comment 2•5 years ago
|
||
It is true that you can see other users email addresses in Bugzilla, but only if you are logged in yourself. We
have warnings on our account creation page about this and it has been this way for many years. We do have
a feature request in progress that will eventually do way with using email addresses as a users login name
and keep the address hidden at all times but it is not yet complete. This bug is not a security issue as the
current behavior is well known.
Description
•