Bradley Baetz

**Name of the Vulnerable Software and Affected Versions** Bugzilla versions 2.22rc1 through 3.2.7 Bugzilla versions 3.3.1 through 3.4.7 Bugzilla versions 3.5.1 through 3.6.1 Bugzilla versions 3.7 through 3.7.2 **Description** The issue is related to the sudo feature in Bugzilla, which does not properly send impersonation notifications. This makes it easier for remote authenticated users to impersonate other users without being discovered. **Recommendations** For versions 2.22rc1 through 3.2.7, update to a version outside of this range to resolve the issue. For versions 3.3.1 through 3.4.7, update to a version outside of this range to resolve the issue. For versions 3.5.1 through 3.6.1, update to a version outside of this range to resolve the issue. For versions 3.7 through 3.7.2, update to a version outside of this range to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Bugzilla versions 2.16.3 and earlier, 2.17.1 through 2.17.4 **Description** The issue allows remote attackers to read a user's voting page when that user has voted on a restricted bug. This is achieved by modifying the `who` parameter in the votes.cgi script, potentially exposing sensitive voting information. **Recommendations** For Bugzilla versions 2.16.3 and earlier, update to a version later than 2.16.3 to resolve the issue. For Bugzilla versions 2.17.1 through 2.17.4, update to a version later than 2.17.4 to resolve the issue. As a temporary workaround, consider restricting access to the votes.cgi script until a patch is available.