CVE-2012-4198: The User.get method in Bugzilla/WebService/User.pm in Bugzilla 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2....

Security readout for executives and security teams

Authenticated Bugzilla users could infer private group names through inconsistent errors in the User.get web service. This is mainly a confidentiality issue: it may reveal internal team, project, customer, or security group names, but the supplied sources do not indicate code execution or account takeover. Exposure is limited to organizations running the affected Bugzilla versions with authenticated users able to access the WebService User.get method. Public anonymous exposure is not supported by the supplied description. Treat as a targeted information-disclosure risk, not an emergency remote compromise. Remediate during normal vulnerability maintenance, faster if Bugzilla group names expose confidential business, customer, or security program information. Mitigation focus: Identify all Bugzilla instances and versions in use.; Upgrade affected branches to fixed Bugzilla versions identified by the advisory lineage.; Prioritize instances with broad user access or sensitive private group names..

Prepared

Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.