PT-2004-1783 · Mozilla · Bugzilla

Published 2004-07-21 · Updated 2017-07-11 · CVE-2004-0703

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.17.1 through 2.17.7

Description The issue concerns an unknown vulnerability in the administrative controls of Bugzilla, where users with "grant membership" privileges can grant memberships to groups they do not control.

Recommendations For Bugzilla versions 2.17.1 through 2.17.7, consider restricting the "grant membership" privilege to prevent unauthorized membership grants until a fix is available.

Fix

Related Identifiers

CVE-2004-0703

Affected Products

Bugzilla

References · 5

• http://securityfocus.com/bid/10698 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0703 · Security Note
• http://marc.info/?l=bugtraq&m=108965446813639&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16672 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0703 · Note