PT-2002-1115 · Mozilla · Bugzilla

Published 2002-01-10 · Updated 2008-09-10 · CVE-2002-0008

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bugzilla versions prior to 2.14.1

Description The issue allows remote attackers to spoof a user comment or post a bug as another user. This can be achieved by manipulating the who parameter in an HTTP request to process bug.cgi, bypassing the need for the Bugzilla login cookie. Alternatively, an attacker can modify the reporter parameter in enter bug.cgi, which is then passed to post bug.cgi, to post a bug under a different user's identity.

Recommendations For versions prior to 2.14.1, update to version 2.14.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the process bug.cgi and enter bug.cgi endpoints to minimize the risk of exploitation. Additionally, avoid using the who and reporter parameters in these endpoints until the issue is resolved.

Fix

Related Identifiers

CVE-2002-0008

Affected Products

Bugzilla

References · 11

• http://bugzilla.mozilla.org/show_bug.cgi?id=108516 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2002-001.html · Vendor Advisory
• http://bugzilla.mozilla.org/show_bug.cgi?id=108385 · Vendor Advisory
• http://bugzilla.org/security2_14_1.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0008 · Security Note
• http://securityfocus.com/bid/3793 · Note
• http://securityfocus.com/bid/3794 · Note
• http://iss.net/security_center/static/7805.php · Note
• http://archives.neohapsis.com/archives/bugtraq/2002-01/0034.html · Note
• http://iss.net/security_center/static/7804.php · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0008 · Note