CVE-2001-1401
First published: Mon Sep 10 2001(Updated: )
Bugzilla before 2.14 does not properly restrict access to confidential bugs, which could allow Bugzilla users to bypass viewing permissions via modified bug id parameters in (1) process_bug.cgi, (2) show_activity.cgi, (3) showvotes.cgi, (4) showdependencytree.cgi, (5) showdependencygraph.cgi, (6) showattachment.cgi, or (7) describecomponents.cgi.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Bugzilla | =2.10 | |
| Mozilla Bugzilla | =2.6 | |
| Mozilla Bugzilla | =2.4 | |
| Mozilla Bugzilla | =2.12 | |
| Mozilla Bugzilla | =2.8 | |
| Mozilla Bugzilla | =2.14 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.redhat.com/support/errata/RHSA-2001-107.html
- http://bugzilla.mozilla.org/show_bug.cgi?id=82781
- http://bugzilla.mozilla.org/show_bug.cgi?id=39531
- http://bugzilla.mozilla.org/show_bug.cgi?id=39524
- http://bugzilla.mozilla.org/show_bug.cgi?id=39533
- http://bugzilla.mozilla.org/show_bug.cgi?id=39526
- http://bugzilla.mozilla.org/show_bug.cgi?id=39527
- http://bugzilla.mozilla.org/show_bug.cgi?id=70189
- http://marc.info/?l=bugtraq&m=99912899900567
Frequently Asked Questions
What is the severity of CVE-2001-1401?
CVE-2001-1401 is classified as a moderate severity vulnerability due to its ability to expose confidential bug information.
How do I fix CVE-2001-1401?
To fix CVE-2001-1401, upgrade Bugzilla to version 2.14 or later.
What type of vulnerability is CVE-2001-1401?
CVE-2001-1401 is an access control vulnerability that allows users to bypass viewing permissions for confidential bugs.
Which versions of Bugzilla are affected by CVE-2001-1401?
CVE-2001-1401 affects Bugzilla versions 2.10 through 2.14.
What components of Bugzilla are involved in CVE-2001-1401?
The components involved in CVE-2001-1401 include process_bug.cgi, show_activity.cgi, showvotes.cgi, and others where the bug ID parameter can be manipulated.
- collector/nvd-historical
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/remedy
- agent/description
- agent/event
- agent/tags
- agent/source
- vendor/mozilla
- canonical/mozilla bugzilla
- version/mozilla bugzilla/2.10
- version/mozilla bugzilla/2.6
- version/mozilla bugzilla/2.4
- version/mozilla bugzilla/2.12
- version/mozilla bugzilla/2.8
- version/mozilla bugzilla/2.14