PT-2001-2500 · Mozilla · Bugzilla

Publicado 2001-09-10 · Atualizado 2016-10-18 · CVE-2001-1401

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bugzilla versions prior to 2.14

Description The issue allows Bugzilla users to bypass viewing permissions for confidential bugs by modifying bug id parameters in various API endpoints, including "process bug.cgi", "show activity.cgi", "showvotes.cgi", "showdependencytree.cgi", "showdependencygraph.cgi", "showattachment.cgi", and "describecomponents.cgi".

Recommendations For versions prior to 2.14, update to version 2.14 or later to resolve the issue. As a temporary workaround, consider restricting access to the aforementioned API endpoints to minimize the risk of exploitation. Avoid using modified bug id parameters in these endpoints until the issue is resolved.

Correção

Identificadores relacionados

CVE-2001-1401

Produtos afetados

Bugzilla

Referências · 11

• http://bugzilla.mozilla.org/show_bug.cgi?id=70189 · Nota
• http://bugzilla.mozilla.org/show_bug.cgi?id=39524 · Nota
• http://bugzilla.mozilla.org/show_bug.cgi?id=39526 · Nota
• http://bugzilla.mozilla.org/show_bug.cgi?id=39533 · Nota
• http://marc.info/?l=bugtraq&m=99912899900567 · Nota
• http://redhat.com/support/errata/RHSA-2001-107.html · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1401 · Nota
• http://bugzilla.mozilla.org/show_bug.cgi?id=39527 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2001-1401 · Nota de Segurança
• http://bugzilla.mozilla.org/show_bug.cgi?id=82781 · Nota
• http://bugzilla.mozilla.org/show_bug.cgi?id=39531 · Nota