CVE-2001-1403: High severity Bugzilla vulnerability
Published Sep 10, 2001
·Updated
Bugzilla before 2.14 includes the username and password in URLs, which could allow attackers to gain privileges by reading the information from the web server logs, or by "shoulder-surfing" and observing the web browser's location bar.
Affected Software
6 affected components
Bugzilla=2.4
Bugzilla=2.6
Bugzilla=2.8
Bugzilla=2.10
Bugzilla=2.12
Bugzilla=2.14
Remediation
Patch Available
Event History
Sep 10, 2001
CVE Published
04:00 AM
Aug 31, 2002
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2001-1403?
CVE-2001-1403 has a medium severity level due to the potential for credential leakage.
2
How do I fix CVE-2001-1403?
To fix CVE-2001-1403, upgrade to Bugzilla version 2.14 or later.
3
What versions of Bugzilla are affected by CVE-2001-1403?
CVE-2001-1403 affects Bugzilla versions 2.10, 2.4, 2.6, 2.8, and 2.12.
4
What are the risks associated with CVE-2001-1403?
The risks associated with CVE-2001-1403 include unauthorized access to user credentials and potential privilege escalation.
5
Can CVE-2001-1403 be exploited by observers?
Yes, CVE-2001-1403 can be exploited by observers through shoulder surfing or accessing web server logs.