PT-2004-1220 · Mozilla · Bugzilla

Goobix + 1 · Publicado 2004-06-03 · Atualizado 2017-07-11 · CVE-2003-1043

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.16.3 and earlier Bugzilla versions 2.17.1 through 2.17.4

Description The issue allows remote authenticated users with editkeywords privileges to execute arbitrary SQL commands. This is achieved by manipulating the id parameter in the "editkeywords.cgi" endpoint.

Recommendations For Bugzilla versions 2.16.3 and earlier, update to a version later than 2.16.3. For Bugzilla versions 2.17.1 through 2.17.4, update to a version later than 2.17.4. As a temporary workaround, consider restricting access to the editkeywords.cgi endpoint for users with editkeywords privileges until a patch is available. Avoid using the id parameter in the editkeywords.cgi endpoint until the issue is resolved.

Correção

Identificadores relacionados

CVE-2003-1043

Produtos afetados

Bugzilla

Referências · 7

• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000774 · Aviso do Fabricante
• http://securityfocus.com/bid/8953 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1043 · Nota
• http://securityfocus.com/archive/1/343185 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-1043 · Nota de Segurança
• http://bugzilla.mozilla.org/show_bug.cgi?id=219044 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/13596 · Nota