PT-2004-1219 · Mozilla · Bugzilla

Andrew Eross + 1 · Published 2004-06-03 · Updated 2017-07-11 · CVE-2003-1042

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.16.3 and earlier

Description The issue allows remote authenticated users with editproducts privileges to execute arbitrary SQL commands. This is achieved by injecting malicious SQL via the product name in the collectstats.pl script.

Recommendations For Bugzilla versions 2.16.3 and earlier, update to a version later than 2.16.3 to resolve the issue.

Fix

Related Identifiers

CVE-2003-1042

Affected Products

Bugzilla

References · 7

• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000774 · Vendor Advisory
• http://securityfocus.com/bid/8953 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-1042 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/13594 · Note
• http://securityfocus.com/archive/1/343185 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1042 · Note
• http://bugzilla.mozilla.org/show_bug.cgi?id=214290 · Note