CVE-2009-3989

no score yetEPSS 1.5%

mozilla bugzilla: no CVSS score yet. EPSS 1.5% chance of exploitation in the next 30 days.

Bugzilla before 3.0.11, 3.2.x before 3.2.6, 3.4.x before 3.4.5, and 3.5.x before 3.5.3 does not block access to files and directories that are used by custom installations, which allows remote attackers to obtain sensitive information via requests for (1) CVS/, (2) contrib/, (3) docs/en/xml/, (4) t/, or (5) old-params.txt.

EPSS: 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
CWE: CWE-264
Published: 2010-02-03
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

mozilla:bugzilla

References

http://secunia.com/advisories/38443
http://www.securityfocus.com/archive/1/509282/100/0/threaded
http://www.securityfocus.com/bid/38025
http://www.vupen.com/english/advisories/2010/0261
https://bugzilla.mozilla.org/show_bug.cgi?id=314871

Check your stack JSON