PT-2004-1221 · Mozilla · Bugzilla

Stefan Mayr · Publicado 2004-06-03 · Atualizado 2017-07-11 · CVE-2003-1044

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.16.3 and earlier

Description The issue arises in editproducts.cgi when usebuggroups is enabled. It fails to properly remove group add privileges from a group that is being deleted. This allows users with those privileges to perform unauthorized additions to the next group that is assigned with the original group ID.

Recommendations For Bugzilla versions 2.16.3 and earlier, update to a version where this issue is resolved to prevent unauthorized group additions.

Correção

Identificadores relacionados

CVE-2003-1044

Produtos afetados

Bugzilla

Referências · 7

• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000774 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/13597 · Nota
• http://securityfocus.com/bid/8953 · Aviso do Fabricante
• http://securityfocus.com/archive/1/343185 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1044 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-1044 · Nota de Segurança
• http://bugzilla.mozilla.org/show_bug.cgi?id=219690 · Nota