CVE-2001-1404: High severity Bugzilla vulnerability
Published Sep 10, 2001
·Updated
Bugzilla before 2.14 stores user passwords in plaintext and sends password requests in an email message, which could allow attackers to gain privileges.
Affected Software
6 affected components
Bugzilla=2.4
Bugzilla=2.6
Bugzilla=2.8
Bugzilla=2.10
Bugzilla=2.12
Bugzilla=2.14
Remediation
Patch Available
Event History
Sep 10, 2001
CVE Published
04:00 AM
Aug 31, 2002
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2001-1404?
CVE-2001-1404 is classified as a high severity vulnerability due to the potential for attackers to gain unauthorized access through plaintext password storage.
2
How do I fix CVE-2001-1404?
To fix CVE-2001-1404, upgrade Bugzilla to version 2.15 or later where password storage is improved.
3
What versions of Bugzilla are affected by CVE-2001-1404?
CVE-2001-1404 affects Bugzilla versions 2.4, 2.6, 2.10, 2.12, 2.14, and 2.8.
4
What are the risks associated with CVE-2001-1404?
The risks associated with CVE-2001-1404 include the leakage of sensitive user credentials and potential unauthorized access to user accounts.
5
Can attackers exploit CVE-2001-1404 remotely?
Yes, attackers can exploit CVE-2001-1404 remotely by intercepting plaintext passwords sent via email.