PT-2001-2501 · Mozilla · Bugzilla

Published 2001-09-10 · Updated 2016-10-18 · CVE-2001-1402

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bugzilla versions prior to 2.14

Description The issue allows remote attackers to conduct unauthorized activities via cross-site scripting (XSS) and possibly SQL injection attacks. This can occur through various parameters and fields in different CGI scripts, including reports.cgi, showvotes.cgi, createaccount.cgi, showdependencytree.cgi, process bug.cgi, and buglist.cgi. The vulnerable parameters and fields include product and output form variables, voteon, bug id, and user variables, invalid email addresses, invalid IDs, invalid usernames, and other fields, as well as error messages.

Recommendations For Bugzilla versions prior to 2.14, update to version 2.14 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected CGI scripts until a patch is available. Avoid using untrusted input in the vulnerable parameters and fields, such as product and output form variables, voteon, bug id, and user variables, until the issue is resolved.

Fix

Related Identifiers

CVE-2001-1402

Affected Products

Bugzilla

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2001-1402 · Security Note
• http://redhat.com/support/errata/RHSA-2001-107.html · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1402 · Note
• http://bugzilla.mozilla.org/show_bug.cgi?id=38855 · Note
• http://marc.info/?l=bugtraq&m=99912899900567 · Note
• http://bugzilla.mozilla.org/show_bug.cgi?id=39536 · Note
• http://bugzilla.mozilla.org/show_bug.cgi?id=87701 · Note
• http://bugzilla.mozilla.org/show_bug.cgi?id=95235 · Note
• http://bugzilla.mozilla.org/show_bug.cgi?id=38859 · Note
• http://bugzilla.mozilla.org/show_bug.cgi?id=38854 · Note