PT-2004-1221 · Mozilla · Bugzilla

Stefan Mayr · Published 2004-06-03 · Updated 2017-07-11 · CVE-2003-1044

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.16.3 and earlier

Description The issue arises in editproducts.cgi when usebuggroups is enabled. It fails to properly remove group add privileges from a group that is being deleted. This allows users with those privileges to perform unauthorized additions to the next group that is assigned with the original group ID.

Recommendations For Bugzilla versions 2.16.3 and earlier, update to a version where this issue is resolved to prevent unauthorized group additions.

Fix

Related Identifiers

CVE-2003-1044

Affected Products

Bugzilla

References · 7

• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000774 · Vendor Advisory
• http://securityfocus.com/bid/8953 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-1044 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/13597 · Note
• http://securityfocus.com/archive/1/343185 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1044 · Note
• http://bugzilla.mozilla.org/show_bug.cgi?id=219690 · Note