CVE

Id
4404  
CVE No.
CVE-2002-0010  
Status
Candidate  
Description
Bugzilla before 2.14.1 allows remote attackers to inject arbitrary SQL code and create files or gain privileges via (1) the sql parameter in buglist.cgi, (2) invalid field names from the "boolean chart" query in buglist.cgi, (3) the mybugslink parameter in userprefs.cgi, (4) a malformed bug ID in the buglist parameter in long_list.cgi, and (5) the value parameter in editusers.cgi, which allows groupset privileges to be modified by attackers with blessgroupset privileges.  
Phase
Modified (20050703)  
Votes
ACCEPT(3) Baker, Cole, Green | NOOP(2) Foat, Wall | REVIEWING(1) Frech  
Comments
Frech> XF:bugzilla-buglist-modify-sql(7807) | XF:bugzilla-userprefs-change-groupset(7809) | XF:bugzilla-longlist-modify-sql(7811) | XF:bugzilla-editusers-change-groupset(7814) | XF:bugzilla-buglist-sql-logic(7813)  

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
21113 4404 CVE-2002-0010 BUGTRAQ:20020105 Security Advisory for Bugzilla v2.15 (cvs20020103) and older  View
21114 4404 CVE-2002-0010 URL:http://archives.neohapsis.com/archives/bugtraq/2002-01/0034.html  View
21115 4404 CVE-2002-0010 BUGTRAQ:20020106 Inproper input validation in Bugzilla <=2.14 - exploit  View
21116 4404 CVE-2002-0010 URL:http://archives.neohapsis.com/archives/bugtraq/2002-01/0052.html  View
21117 4404 CVE-2002-0010 CONFIRM:http://www.bugzilla.org/security2_14_1.html  View
21118 4404 CVE-2002-0010 REDHAT:RHSA-2002:001  View
21119 4404 CVE-2002-0010 URL:http://rhn.redhat.com/errata/RHSA-2002-001.html  View
21120 4404 CVE-2002-0010 MISC:http://bugzilla.mozilla.org/show_bug.cgi?id=108812  View
21121 4404 CVE-2002-0010 MISC:http://bugzilla.mozilla.org/show_bug.cgi?id=108822  View
21122 4404 CVE-2002-0010 MISC:http://bugzilla.mozilla.org/show_bug.cgi?id=108821  View
21123 4404 CVE-2002-0010 MISC:http://bugzilla.mozilla.org/show_bug.cgi?id=109690  View
21124 4404 CVE-2002-0010 MISC:http://bugzilla.mozilla.org/show_bug.cgi?id=109679  View
21125 4404 CVE-2002-0010 MISC:http://www.bugzilla.org/bugzilla2.14to2.14.1.patch  View
21126 4404 CVE-2002-0010 BID:3801  View
21127 4404 CVE-2002-0010 URL:http://www.securityfocus.com/bid/3801  View
21128 4404 CVE-2002-0010 BID:3802  View
21129 4404 CVE-2002-0010 URL:http://www.securityfocus.com/bid/3802  View
21130 4404 CVE-2002-0010 BID:3804  View
21131 4404 CVE-2002-0010 URL:http://www.securityfocus.com/bid/3804  View
21132 4404 CVE-2002-0010 BID:3805  View
21133 4404 CVE-2002-0010 URL:http://www.securityfocus.com/bid/3805  View
21134 4404 CVE-2002-0010 XF:bugzilla-buglist-modify-sql(7807)  View
21135 4404 CVE-2002-0010 URL:http://www.iss.net/security_center/static/7807.php  View
21136 4404 CVE-2002-0010 XF:bugzilla-editusers-change-groupset(7814)  View
21137 4404 CVE-2002-0010 URL:http://www.iss.net/security_center/static/7814.php  View
21138 4404 CVE-2002-0010 XF:bugzilla-buglist-sql-logic(7813)  View
21139 4404 CVE-2002-0010 URL:http://www.iss.net/security_center/static/7813.php  View
21140 4404 CVE-2002-0010 XF:bugzilla-longlist-modify-sql(7811)  View
21141 4404 CVE-2002-0010 URL:http://www.iss.net/security_center/static/7811.php  View
21142 4404 CVE-2002-0010 XF:bugzilla-userprefs-change-groupset(7809)  View

Related JVN