PT-2004-2539 · Mozilla · Bugzilla

Casey Klein · Publicado 2004-10-25 · Atualizado 2017-07-11 · CVE-2004-1633

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.9 through 2.18rc2 Bugzilla version 2.19 from CVS

Description The issue allows remote authenticated users to modify the keywords in a bug. This is due to the process bug.cgi script not checking edit permissions on the keywords field. The modification can be done via the keywordaction parameter.

Recommendations For Bugzilla versions 2.9 through 2.18rc2, restrict access to the process bug.cgi script until a fix is available. For Bugzilla version 2.19 from CVS, avoid using the keywordaction parameter in the process bug.cgi script until the issue is resolved.

Correção

Identificadores relacionados

CVE-2004-1633

Produtos afetados

Bugzilla

Referências · 5

• http://marc.info/?l=bugtraq&m=109872095201238&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-1633 · Nota de Segurança
• https://bugzilla.mozilla.org/show_bug.cgi?id=252638 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17840 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1633 · Nota