PT-2005-2543 · Mozilla · Bugzilla

Frédéric Buclin + 1 · Published 2005-05-12 · Updated 2017-07-11 · CVE-2005-1564

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.10 through 2.18 Bugzilla version 2.19.1 Bugzilla version 2.19.2

Description The issue allows remote authenticated users to enter bugs into products that are closed for bug entry by modifying the URL to specify the name of the product. This is possible due to a flaw in the post bug.cgi script.

Recommendations For Bugzilla versions 2.10 through 2.18, update the post bug.cgi script to properly validate product permissions. For Bugzilla version 2.19.1, restrict access to the post bug.cgi script until a proper fix is applied. For Bugzilla version 2.19.2, consider disabling the post bug.cgi script temporarily to prevent unauthorized bug entry.

Exploit

Fix

Related Identifiers

CVE-2005-1564

Affected Products

Bugzilla

References · 8

• 🔥 http://bugzilla.org/security/2.16.8 · Exploit
• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=287109 · Exploit
• http://osvdb.org/16426 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-1564 · Security Note
• http://secunia.com/advisories/15338 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=111592031902962&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1564 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42797 · Note