PT-2001-2500 · Mozilla · Bugzilla

Published 2001-09-10 · Updated 2016-10-18 · CVE-2001-1401

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bugzilla versions prior to 2.14

Description The issue allows Bugzilla users to bypass viewing permissions for confidential bugs by modifying bug id parameters in various API endpoints, including "process bug.cgi", "show activity.cgi", "showvotes.cgi", "showdependencytree.cgi", "showdependencygraph.cgi", "showattachment.cgi", and "describecomponents.cgi".

Recommendations For versions prior to 2.14, update to version 2.14 or later to resolve the issue. As a temporary workaround, consider restricting access to the aforementioned API endpoints to minimize the risk of exploitation. Avoid using modified bug id parameters in these endpoints until the issue is resolved.

Fix

Related Identifiers

CVE-2001-1401

Affected Products

Bugzilla

References · 11

• http://redhat.com/support/errata/RHSA-2001-107.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-1401 · Security Note
• http://bugzilla.mozilla.org/show_bug.cgi?id=70189 · Note
• http://bugzilla.mozilla.org/show_bug.cgi?id=39524 · Note
• http://bugzilla.mozilla.org/show_bug.cgi?id=39526 · Note
• http://bugzilla.mozilla.org/show_bug.cgi?id=39533 · Note
• http://marc.info/?l=bugtraq&m=99912899900567 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1401 · Note
• http://bugzilla.mozilla.org/show_bug.cgi?id=39527 · Note
• http://bugzilla.mozilla.org/show_bug.cgi?id=82781 · Note
• http://bugzilla.mozilla.org/show_bug.cgi?id=39531 · Note