PT-2001-2501 · Mozilla · Bugzilla

Publicado 2001-09-10 · Atualizado 2016-10-18 · CVE-2001-1402

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bugzilla versions prior to 2.14

Description The issue allows remote attackers to conduct unauthorized activities via cross-site scripting (XSS) and possibly SQL injection attacks. This can occur through various parameters and fields in different CGI scripts, including reports.cgi, showvotes.cgi, createaccount.cgi, showdependencytree.cgi, process bug.cgi, and buglist.cgi. The vulnerable parameters and fields include product and output form variables, voteon, bug id, and user variables, invalid email addresses, invalid IDs, invalid usernames, and other fields, as well as error messages.

Recommendations For Bugzilla versions prior to 2.14, update to version 2.14 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected CGI scripts until a patch is available. Avoid using untrusted input in the vulnerable parameters and fields, such as product and output form variables, voteon, bug id, and user variables, until the issue is resolved.

Correção

Identificadores relacionados

CVE-2001-1402

Produtos afetados

Bugzilla

Referências · 10

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1402 · Nota
• http://bugzilla.mozilla.org/show_bug.cgi?id=38855 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2001-1402 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=99912899900567 · Nota
• http://redhat.com/support/errata/RHSA-2001-107.html · Aviso do Fabricante
• http://bugzilla.mozilla.org/show_bug.cgi?id=39536 · Nota
• http://bugzilla.mozilla.org/show_bug.cgi?id=87701 · Nota
• http://bugzilla.mozilla.org/show_bug.cgi?id=95235 · Nota
• http://bugzilla.mozilla.org/show_bug.cgi?id=38859 · Nota
• http://bugzilla.mozilla.org/show_bug.cgi?id=38854 · Nota