Vulnerabilities > CVE-2001-1402 - Cross-Site Scripting vulnerability in Bugzilla
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
Bugzilla before 2.14 does not properly escape untrusted parameters, which could allow remote attackers to conduct unauthorized activities via cross-site scripting (CSS) and possibly SQL injection attacks on (1) the product or output form variables for reports.cgi, (2) the voteon, bug_id, and user variables for showvotes.cgi, (3) an invalid email address in createaccount.cgi, (4) an invalid ID in showdependencytree.cgi, (5) invalid usernames and other fields in process_bug.cgi, and (6) error messages in buglist.cgi.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 6 |
Redhat
| advisories |
|
References
- http://bugzilla.mozilla.org/show_bug.cgi?id=38854
- http://bugzilla.mozilla.org/show_bug.cgi?id=38855
- http://bugzilla.mozilla.org/show_bug.cgi?id=38859
- http://bugzilla.mozilla.org/show_bug.cgi?id=39536
- http://bugzilla.mozilla.org/show_bug.cgi?id=87701
- http://bugzilla.mozilla.org/show_bug.cgi?id=95235
- http://marc.info/?l=bugtraq&m=99912899900567
- http://www.redhat.com/support/errata/RHSA-2001-107.html