CVE-2002-0010

Published: Jan 31, 2002Modified: Apr 16, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

Bugzilla before 2.14.1 allows remote attackers to inject arbitrary SQL code and create files or gain privileges via (1) the sql parameter in buglist.cgi, (2) invalid field names from the "boolean chart" query in buglist.cgi, (3) the mybugslink parameter in userprefs.cgi, (4) a malformed bug ID in the buglist parameter in long_list.cgi, and (5) the value parameter in editusers.cgi, which allows groupset privileges to be modified by attackers with blessgroupset privileges.

Affected (1)

Products: Mozilla: Bugzilla

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mozilla Bugzilla	Up to 2.14.1

References (38)

http://archives.neohapsis.com/archives/bugtraq/2002-01/0034.html

Source: cve@mitre.org

PatchVendor Advisory

http://archives.neohapsis.com/archives/bugtraq/2002-01/0052.html

Source: cve@mitre.org

http://bugzilla.mozilla.org/show_bug.cgi?id=108812

Source: cve@mitre.org

http://bugzilla.mozilla.org/show_bug.cgi?id=108821

Source: cve@mitre.org

http://bugzilla.mozilla.org/show_bug.cgi?id=108822

Source: cve@mitre.org

http://bugzilla.mozilla.org/show_bug.cgi?id=109679

Source: cve@mitre.org

http://bugzilla.mozilla.org/show_bug.cgi?id=109690

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2002-001.html

Source: cve@mitre.org

http://www.bugzilla.org/bugzilla2.14to2.14.1.patch

Source: cve@mitre.org

http://www.bugzilla.org/security2_14_1.html

Source: cve@mitre.org

http://www.iss.net/security_center/static/7807.php

Source: cve@mitre.org

http://www.iss.net/security_center/static/7809.php

Source: cve@mitre.org

http://www.iss.net/security_center/static/7811.php

Source: cve@mitre.org

http://www.iss.net/security_center/static/7813.php

Source: cve@mitre.org

http://www.iss.net/security_center/static/7814.php

Source: cve@mitre.org

http://www.securityfocus.com/bid/3801

Source: cve@mitre.org

http://www.securityfocus.com/bid/3802

Source: cve@mitre.org

http://www.securityfocus.com/bid/3804

Source: cve@mitre.org

http://www.securityfocus.com/bid/3805

Source: cve@mitre.org

http://archives.neohapsis.com/archives/bugtraq/2002-01/0034.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://archives.neohapsis.com/archives/bugtraq/2002-01/0052.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://bugzilla.mozilla.org/show_bug.cgi?id=108812

Source: af854a3a-2127-422b-91ae-364da2661108

http://bugzilla.mozilla.org/show_bug.cgi?id=108821

Source: af854a3a-2127-422b-91ae-364da2661108

http://bugzilla.mozilla.org/show_bug.cgi?id=108822

Source: af854a3a-2127-422b-91ae-364da2661108

http://bugzilla.mozilla.org/show_bug.cgi?id=109679

Source: af854a3a-2127-422b-91ae-364da2661108

http://bugzilla.mozilla.org/show_bug.cgi?id=109690

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2002-001.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.bugzilla.org/bugzilla2.14to2.14.1.patch

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.bugzilla.org/security2_14_1.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.iss.net/security_center/static/7807.php

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.iss.net/security_center/static/7809.php

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.iss.net/security_center/static/7811.php

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.iss.net/security_center/static/7813.php

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.iss.net/security_center/static/7814.php

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/3801

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/3802

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/3804

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/3805

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.