CVE-2012-4197: Bugzilla/Attachment.pm in attachment.cgi in Bugzilla 2.x and 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0....

Security readout for executives and security teams

CVE-2012-4197 is an information disclosure flaw in Bugzilla. A remote attacker could read attachment descriptions tied to private bugs through a specific obsolete attachment action. The sources describe exposure of descriptions, not full private bug contents or attachment files. Exposure is most relevant to organizations running old Bugzilla instances with private bugs and attachment metadata. Public-only trackers have lower business impact. The provided CVE data does not identify affected downstream products beyond Bugzilla itself. Treat this as a confidentiality issue for legacy Bugzilla systems. Prioritize remediation if private security, legal, customer, or product vulnerability discussions used attachment descriptions. Mitigation focus: Upgrade Bugzilla to a fixed release named by the advisory.; Check Bugzilla vendor guidance for branch-specific upgrade instructions.; Identify private bug workflows that rely on attachment descriptions..

Prepared

Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.