CVE-2002-0010
- State
- Published
- Severity
- Not scored
- Published
- Jan 10, 2002
- Updated
- Aug 8, 2024
- Reserved
- Jan 9, 2002
Description
Bugzilla before 2.14.1 allows remote attackers to inject arbitrary SQL code and create files or gain privileges via (1) the sql parameter in buglist.cgi, (2) invalid field names from the "boolean chart" query in buglist.cgi, (3) the mybugslink parameter in userprefs.cgi, (4) a malformed bug ID in the buglist parameter in long_list.cgi, and (5) the value parameter in editusers.cgi, which allows groupset privileges to be modified by attackers with blessgroupset privileges.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 20020106 Inproper input validation in Bugzilla <=2.14 - exploitmailing-list
- 3805vdb-entry
- 3802vdb-entry
- 3801vdb-entry
- bugzilla-longlist-modify-sql(7811)vdb-entry
- bugzilla-editusers-change-groupset(7814)vdb-entry
- http://bugzilla.mozilla.org/show_bug.cgi?id=108821
- bugzilla-buglist-sql-logic(7813)vdb-entry
- http://bugzilla.mozilla.org/show_bug.cgi?id=108812
- RHSA-2002:001vendor-advisory
- 20020105 Security Advisory for Bugzilla v2.15 (cvs20020103) and oldermailing-list
- bugzilla-buglist-modify-sql(7807)vdb-entry
- http://www.bugzilla.org/bugzilla2.14to2.14.1.patch
- http://bugzilla.mozilla.org/show_bug.cgi?id=108822
- http://www.bugzilla.org/security2_14_1.html
- bugzilla-userprefs-change-groupset(7809)vdb-entry
- http://bugzilla.mozilla.org/show_bug.cgi?id=109679
- 3804vdb-entry
- http://bugzilla.mozilla.org/show_bug.cgi?id=109690
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.