Vulnerability record · CVE-2012-4199 · published 16 November 2012

CVE-2012-4199: Mozilla bugzilla information exposure vulnerability

Mozilla · Bugzilla

template/en/default/bug/field-events.js.tmpl in Bugzilla 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 generates JavaScript function calls containing private product names or private component names in certain circumstances involving custom-field visibility control, which allows remote attackers to obtain sensitive information by reading HTML source code.

4.3 CVSS 2.0 Medium EPSS 0.96% · top 39.9% CWE-200 · Information exposure

4.3CVSS 2.0 base score

0.96%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

8References

16 Jun 2026Last modified by NVD

Description

AV:N/AC:M/Au:N/C:P/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Bugzilla Mozilla

References

Link	Tags
http://www.bugzilla.org/security/3.6.11/	Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2013:066
https://bugzilla.mozilla.org/show_bug.cgi?id=731178
https://exchange.xforce.ibmcloud.com/vulnerabilities/80029
http://www.bugzilla.org/security/3.6.11/	Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2013:066
https://bugzilla.mozilla.org/show_bug.cgi?id=731178
https://exchange.xforce.ibmcloud.com/vulnerabilities/80029

Track CVE-2012-4199 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2003-1042Mozilla bugzilla vulnerabilitySQL injection vulnerability in collectstats.pl for Bugzilla 2.16.3 and earlier allows remote authenticated users with editproducts privileges to exec…EPSS 2.6%18 Aug 2004 10.0CVE-2003-1043Mozilla bugzilla vulnerabilitySQL injection vulnerability in Bugzilla 2.16.3 and earlier, and 2.17.1 through 2.17.4, allows remote authenticated users with editkeywords privileges…EPSS 2.6%18 Aug 2004 10.0CVE-2004-0769Mozilla bugzilla vulnerabilityBuffer overflow in LHA allows remote attackers to execute arbitrary code via long pathnames in LHarc format 2 headers for a .LHZ archive, as original…EPSS 7.1%18 Aug 2004 10.0CVE-2002-0007Mozilla bugzilla vulnerabilityCGI.pl in Bugzilla before 2.14.1, when using LDAP, allows remote attackers to obtain an anonymous bind to the LDAP server via a request that does not…EPSS 2.4%31 Jan 2002 8.8CVE-2018-5123Mozilla bugzilla cross-site request forgery vulnerabilityA third party website can access information available to a user with access to a restricted bug entry using the image generation in report.cgi in al…EPSS 0.50%29 Apr 2019 7.5CVE-2015-4499Mozilla bugzilla improper input validation vulnerabilityUtil.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.15, 4.3.x and 4.4.x before 4.4.10, and 5.x before 5.0.1 mishandles long e-mail addresses during acco…EPSS 3.4%14 Sep 2015 7.5CVE-2010-4568Mozilla bugzilla permissions and access controls vulnerabilityBugzilla 2.14 through 2.22.7; 3.0.x, 3.1.x, and 3.2.x before 3.2.10; 3.4.x before 3.4.10; 3.6.x before 3.6.4; and 4.0.x before 4.0rc2 does not proper…EPSS 2.5%28 Jan 2011 7.5CVE-2009-3125Mozilla bugzilla sql injection vulnerabilitySQL injection vulnerability in the Bug.search WebService function in Bugzilla 3.3.2 through 3.4.1, and 3.5, allows remote attackers to execute arbitr…EPSS 1.4%15 Sep 2009

Source: NIST National Vulnerability Database (record CVE-2012-4199), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.