7.5high
CVE-2003-1044
editproducts.cgi in Bugzilla 2.16.3 and earlier, when usebuggroups is enabled, does not properly remove group add privileges from a group t…
Published 22 y ago · modified 4 mo ago · JSON
CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.2%
percentile 67%
Public exploits
0
none known
Summary
editproducts.cgi in Bugzilla 2.16.3 and earlier, when usebuggroups is enabled, does not properly remove group add privileges from a group that is being deleted, which allows users with those privileges to perform unauthorized additions to the next group that is assigned with the original group ID.
Exploit prediction (EPSS)
1.16% probability of exploitation in the next 30 days, higher than 67% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
- securityfocus.com /archive/1/343185 · mailing-list, x_refsource_BUGTRAQ, x_transferred
- exchange.xforce.ibmcloud.com /vulnerabilities/13597 · vdb-entry, x_refsource_XF, x_transferred
- bugzilla.mozilla.org /show_bug.cgi?id=219690 · x_refsource_CONFIRM, x_transferred
- distro.conectiva.com.br /atualizacoes/?id=a&anuncio=000774 · vendor-advisory, x_refsource_CONECTIVA, x_transferred
- securityfocus.com /bid/8953 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2003-1044
- NVD: CVE-2003-1044
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.