PT-2002-1115 · Mozilla · Bugzilla

Publicado 2002-01-10 · Atualizado 2008-09-10 · CVE-2002-0008

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bugzilla versions prior to 2.14.1

Description The issue allows remote attackers to spoof a user comment or post a bug as another user. This can be achieved by manipulating the who parameter in an HTTP request to process bug.cgi, bypassing the need for the Bugzilla login cookie. Alternatively, an attacker can modify the reporter parameter in enter bug.cgi, which is then passed to post bug.cgi, to post a bug under a different user's identity.

Recommendations For versions prior to 2.14.1, update to version 2.14.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the process bug.cgi and enter bug.cgi endpoints to minimize the risk of exploitation. Additionally, avoid using the who and reporter parameters in these endpoints until the issue is resolved.

Correção

Identificadores relacionados

CVE-2002-0008

Produtos afetados

Bugzilla

Referências · 11

• http://bugzilla.mozilla.org/show_bug.cgi?id=108516 · Aviso do Fabricante
• http://securityfocus.com/bid/3793 · Nota
• http://securityfocus.com/bid/3794 · Nota
• http://rhn.redhat.com/errata/RHSA-2002-001.html · Aviso do Fabricante
• http://iss.net/security_center/static/7805.php · Nota
• http://bugzilla.mozilla.org/show_bug.cgi?id=108385 · Aviso do Fabricante
• http://archives.neohapsis.com/archives/bugtraq/2002-01/0034.html · Nota
• http://iss.net/security_center/static/7804.php · Nota
• http://bugzilla.org/security2_14_1.html · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0008 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-0008 · Nota de Segurança