7.5

CVE-2002-0809

Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, does not properly handle URL-encoded field names that are generated by some browsers, which could cause certain fields to appear to be unset, which has the effect of removing group permissions on bugs when buglist.cgi is provided with the encoded field names.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mozilla ≫ Bugzilla Version2.14
Mozilla ≫ Bugzilla Version2.14.1
Mozilla ≫ Bugzilla Version2.16
Mozilla ≫ Bugzilla Version2.16 Updaterc1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.12% 0.618
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://archives.neohapsis.com/archives/bugtraq/2002-06/0054.html
Patch
Vendor Advisory
http://www.securityfocus.com/bid/4964
http://www.redhat.com/support/errata/RHSA-2002-109.html
http://bugzilla.mozilla.org/show_bug.cgi?id=148674
http://www.iss.net/security_center/static/10141.php