CVE-2010-2756

CVE-2010-2756 describes an information disclosure vulnerability in Bugzilla versions 2.19.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2. Remote attackers can exploit this flaw, specifically within the Search.pm component, to determine the group memberships of arbitrary users. The vulnerability leverages the Search interface, boolean charts, and group-based pronouns. Rated with a CVSS score of 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N), this vulnerability is remotely exploitable with low attack complexity and requires no authentication. The primary impact is a partial loss of confidentiality, as it allows unauthorized disclosure of user group affiliations. There is no impact on integrity or availability. Currently, there is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. The CVE has received minimal community discussion and media coverage, suggesting a low level of public awareness or concern.