CVE-2012-4747: Bugzilla 2.x and 3.x through 3.6.11, 3.7.x and 4.0.x before 4.0.8, 4.1.x and 4.2.x before 4.2.3, and 4.3.x...

Security readout for executives and security teams

Older Bugzilla installations may expose files that should not be directly readable from the web. A remote unauthenticated user could request templates, custom extension files, or custom documentation under specific web-root paths and read potentially sensitive implementation or business information. Exposure is most likely for internet-accessible Bugzilla deployments running the listed legacy versions, especially with custom templates, extensions, or documentation stored under web-served directories. Treat as a cleanup priority for legacy Bugzilla. It is not sourced as actively exploited, but public issue trackers can contain sensitive engineering, security, and customer data that should not leak through web-accessible files. Mitigation focus: Upgrade Bugzilla to a version outside the listed affected ranges.; Use Bugzilla security advisory guidance for branch-specific fixes.; Restrict public access to affected Bugzilla instances until remediated..

Prepared

Jun 28, 2026, 00:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.