PT-2004-1219 · Mozilla · Bugzilla

Andrew Eross + 1 · Publicado 2004-06-03 · Atualizado 2017-07-11 · CVE-2003-1042

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.16.3 and earlier

Description The issue allows remote authenticated users with editproducts privileges to execute arbitrary SQL commands. This is achieved by injecting malicious SQL via the product name in the collectstats.pl script.

Recommendations For Bugzilla versions 2.16.3 and earlier, update to a version later than 2.16.3 to resolve the issue.

Correção

Identificadores relacionados

CVE-2003-1042

Produtos afetados

Bugzilla

Referências · 7

• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000774 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/13594 · Nota
• http://securityfocus.com/bid/8953 · Aviso do Fabricante
• http://securityfocus.com/archive/1/343185 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-1042 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1042 · Nota
• http://bugzilla.mozilla.org/show_bug.cgi?id=214290 · Nota