PT-2001-2505 · Mozilla · Bugzilla

Published 2001-09-10 · Updated 2016-10-18 · CVE-2001-1406

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bugzilla versions prior to 2.14

Description The issue arises from the process bug.cgi script in Bugzilla, which fails to update the group settings when a bug is moved between product groups. This results in the bug retaining the old group's restrictions, potentially leading to less stringent access controls.

Recommendations For versions prior to 2.14, update to version 2.14 or later to resolve the issue.

Fix

Related Identifiers

CVE-2001-1406

Affected Products

Bugzilla

References · 6

• http://redhat.com/support/errata/RHSA-2001-107.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-1406 · Security Note
• http://bugzilla.mozilla.org/show_bug.cgi?id=66235 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1406 · Note
• http://iss.net/security_center/static/10478.php · Note
• http://marc.info/?l=bugtraq&m=99912899900567 · Note