CVE-2009-3387: Bugzilla 3.3.1 through 3.4.4, 3.5.1, and 3.5.2 does not allow group restrictions to be preserved throughout...

Security readout for executives and security teams

This flaw affects older Bugzilla versions and can expose information from restricted bugs when a bug is moved between product categories. The business risk is unauthorized disclosure of sensitive issue details, but the sources do not show active exploitation or provide a CVSS score. Exposure is most likely in legacy Bugzilla deployments running the listed affected versions and using group restrictions to protect sensitive bugs. Organizations without Bugzilla, or with supported patched releases, are unlikely to be exposed based on the provided evidence. Treat this as a targeted legacy-platform confidentiality issue. It is not supported as actively exploited in the sources, but it matters where Bugzilla holds security bugs, customer data, or internal incident details. Mitigation focus: Inventory Bugzilla deployments and identify exact versions in use.; Prioritize systems running Bugzilla 3.3.1 through 3.4.4, 3.5.1, or 3.5.2.; Review vendor Bugzilla security guidance for the correct upgrade or patch path..

Prepared

Jun 28, 2026, 03:36 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.