PT-2004-1785 · Mozilla · Bugzilla

Jouni Heikniemi · Publicado 2004-07-21 · Atualizado 2017-07-11 · CVE-2004-0705

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.16.x through 2.16.5 Bugzilla versions 2.18 before 2.18rc1

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in various CGI scripts, including editcomponents.cgi, editgroups.cgi, editmilestones.cgi, editproducts.cgi, editusers.cgi, and editversions.cgi. These vulnerabilities allow remote attackers to execute arbitrary JavaScript as other users via a URL parameter.

Recommendations For Bugzilla versions 2.16.x through 2.16.5, update to version 2.16.6 or later. For Bugzilla versions 2.18 before 2.18rc1, update to version 2.18rc1 or later. As a temporary workaround, consider restricting access to the vulnerable CGI scripts until a patch is available.

Correção

Identificadores relacionados

CVE-2004-0705

Produtos afetados

Bugzilla

Referências · 6

• http://marc.info/?l=bugtraq&m=108965446813639&w=2 · Nota
• http://securityfocus.com/bid/10698 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0705 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-0705 · Nota de Segurança
• http://bugzilla.mozilla.org/show_bug.cgi?id=235265 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16670 · Nota