PT-2004-1785 · Mozilla · Bugzilla

Jouni Heikniemi · Published 2004-07-21 · Updated 2017-07-11 · CVE-2004-0705

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.16.x through 2.16.5 Bugzilla versions 2.18 before 2.18rc1

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in various CGI scripts, including editcomponents.cgi, editgroups.cgi, editmilestones.cgi, editproducts.cgi, editusers.cgi, and editversions.cgi. These vulnerabilities allow remote attackers to execute arbitrary JavaScript as other users via a URL parameter.

Recommendations For Bugzilla versions 2.16.x through 2.16.5, update to version 2.16.6 or later. For Bugzilla versions 2.18 before 2.18rc1, update to version 2.18rc1 or later. As a temporary workaround, consider restricting access to the vulnerable CGI scripts until a patch is available.

Fix

Related Identifiers

CVE-2004-0705

Affected Products

Bugzilla

References · 6

• http://securityfocus.com/bid/10698 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0705 · Security Note
• http://marc.info/?l=bugtraq&m=108965446813639&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0705 · Note
• http://bugzilla.mozilla.org/show_bug.cgi?id=235265 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16670 · Note