PT-2004-1220 · Mozilla · Bugzilla

Goobix + 1 · Published 2004-06-03 · Updated 2017-07-11 · CVE-2003-1043

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.16.3 and earlier Bugzilla versions 2.17.1 through 2.17.4

Description The issue allows remote authenticated users with editkeywords privileges to execute arbitrary SQL commands. This is achieved by manipulating the id parameter in the "editkeywords.cgi" endpoint.

Recommendations For Bugzilla versions 2.16.3 and earlier, update to a version later than 2.16.3. For Bugzilla versions 2.17.1 through 2.17.4, update to a version later than 2.17.4. As a temporary workaround, consider restricting access to the editkeywords.cgi endpoint for users with editkeywords privileges until a patch is available. Avoid using the id parameter in the editkeywords.cgi endpoint until the issue is resolved.

Fix

Related Identifiers

CVE-2003-1043

Affected Products

Bugzilla

References · 7

• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000774 · Vendor Advisory
• http://securityfocus.com/bid/8953 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-1043 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1043 · Note
• http://securityfocus.com/archive/1/343185 · Note
• http://bugzilla.mozilla.org/show_bug.cgi?id=219044 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/13596 · Note