Description
Bugzilla before 2.14 allows Bugzilla users to bypass group security checks by marking a bug as the duplicate of a restricted bug, which adds the user to the CC list of the restricted bug and allows the user to view the bug.
Affected products
- Mozilla / Bugzilla2.4 – 2.4
- Mozilla / Bugzilla2.6 – 2.6
- Mozilla / Bugzilla2.8 – 2.8
- Mozilla / Bugzilla2.10 – 2.10
- Mozilla / Bugzilla2.12 – 2.12
- Mozilla / Bugzilla2.14 – 2.14