CVE-2010-0180 — Install/Filesystem.pm in Bugzilla 3.5.1 through 3.6 and 3.7, when use_suexec is enabled, uses world-readable permissions for the localconfig files, which allows local users to read sensitive configuration fields, as demonstrated by the database password field and the site_wide_secret field

Back Back to CVE browser

LOW

Install/Filesystem.pm in Bugzilla 3.5.1 through 3.6 and 3.7, when use_suexec is enabled, uses world-readable permissions for the localconfig files, which allows local users to read sensitive configuration fields, as demonstrated by the database password field and the site_wide_secret field

Published Jun 28, 2010

1.9

LOW

CVSS 2.0

EPSS 0.24%

Description

Install/Filesystem.pm in Bugzilla 3.5.1 through 3.6 and 3.7, when use_suexec is enabled, uses world-readable permissions for the localconfig files, which allows local users to read sensitive configuration fields, as demonstrated by the database password field and the site_wide_secret field.

Affected products

Remediation

No remediation recorded yet.

Metrics

0.24% 0.00236

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00236

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (9 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.24% (0.00236)	13.22th	v5 (v2026.06.15)
Jun 15, 2026	0.24% (0.00236)	14.34th	v5 (v2026.06.15)
Mar 17, 2025	0.05% (0.00053)	13.55th	v4 (v2025.03.14)
Dec 12, 2024	0.04% (0.00042)	5.07th	v3 (v2023.03.01)
Mar 7, 2023	0.04% (0.00042)	5.63th	v3 (v2023.03.01)
Mar 6, 2023	0.95% (0.00950)	32.28th	v2 (v2022.01.01)
Sep 10, 2022	0.95% (0.00950)	30.63th	v2 (v2022.01.01)
Apr 1, 2022	0.95% (0.00950)	28.61th	v2 (v2022.01.01)
Feb 4, 2022	0.95% (0.00950)	13.46th	v2 (v2022.01.01)

Weaknesses (1)

CWE-264

References (5)

http://secunia.com/advisories/40300
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.bugzilla.org/security/3.2.6/
x_refsource_CONFIRMVendor Advisory
http://www.securityfocus.com/bid/41144
vdb-entryx_refsource_BID
http://www.vupen.com/english/advisories/2010/1595
vdb-entryx_refsource_VUPENVendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=561797
x_refsource_CONFIRM

Link	Providers	Tags
http://secunia.com/advisories/40300		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.bugzilla.org/security/3.2.6/		x_refsource_CONFIRMVendor Advisory
http://www.securityfocus.com/bid/41144		vdb-entryx_refsource_BID
http://www.vupen.com/english/advisories/2010/1595		vdb-entryx_refsource_VUPENVendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=561797		x_refsource_CONFIRM

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jun 28, 2010

Updated Sep 16, 2024

Reserved Jan 6, 2010

Link CVE-2010-0180

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 16, 2026

Link CVE-2010-0180

Red Hat

Severity n/a

Public date n/a

Links CVE-2010-0180