986774 - Full Path Disclosure (FPD) vulnerabilities found in http://bzr.mozilla.org/

Status: RESOLVED FIXED

(Websites :: other.mozilla.org, defect)

Description

[theliam911]

Attachment: Screen Shot 2014-03-22 at 11.26.39 AM.png

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.152 Safari/537.36

Steps to reproduce:

open the browser, go to 

http://bzr.mozilla.org/bugzilla/4.4/revision/8513/extensions/MoreBugUrl/lib/PHP.pm?remember=8537&compare_revid=1a


Actual results:

the page will show the absolute path of the server

/var/www/html/bzr.mozilla.org/bugzilla/.bzr/repository/


Expected results:

the page will show the error message exclude absolute path of the server

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

This site is not officially in our list of eligible sites. If the bug is extraordinary we sometimes offer bounties for interesting bugs which are outside of normal policy.

We do appreciate learning about bugs in all of our sites. We publish a list of eligible sites for people who are only interested in bounties and we hope that can help reduce the frustration of wasting time in unfruitful areas.
http://www.mozilla.org/security/bug-bounty-faq-webapp.html#eligible-bugs

Comment 3

[Adam Muntner [:adamm] (use NEEDINFO)]

Site moved, error messages only show relative path on new server. Closing.