Vulnerability in Mozilla Bugzilla

CVE-2004-1633

process_bug.cgi in Bugzilla 2.9 through 2.18rc2 and 2.19 from CVS does not check edit permissions on the keywords field, which allows remote authenticated users to modify the keywords in a bug via the keywordaction parameter.

EPSS: 0.012 (64.0th percentile) — read the EPSS interpretation.

Affected products

Mozilla Bugzilla — versions 2.9, 2.10, 2.12
N/a — versions n/a

References

cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
cve@mitre.org (vdb-entry, x_refsource_XF)
cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)