CVE-2001-1406: Low severity Bugzilla vulnerability
Published Sep 10, 2001
·Updated
processbug.cgi in Bugzilla before 2.14 does not set the "groupset" bit when a bug is moved between product groups, which will cause the bug to have the old group's restrictions, which might not be as stringent.
Affected Software
6 affected components
Bugzilla=2.10
Bugzilla=2.6
Bugzilla=2.4
Bugzilla=2.12
Bugzilla=2.8
Bugzilla=2.14
Remediation
Patch Available
Event History
Sep 10, 2001
CVE Published
04:00 AM
Apr 2, 2003
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2001-1406?
CVE-2001-1406 has been classified as a moderate severity vulnerability.
2
How do I fix CVE-2001-1406?
To fix CVE-2001-1406, upgrade your Bugzilla installation to version 2.15 or later.
3
Which versions of Bugzilla are affected by CVE-2001-1406?
CVE-2001-1406 affects Bugzilla versions prior to 2.15, specifically 2.10, 2.4, 2.6, 2.8, 2.12, and 2.14.
4
What impact does CVE-2001-1406 have on Bugzilla?
CVE-2001-1406 can allow a bug to inherit less stringent restrictions from an old group when moved between product groups.
5
Is there a workaround for CVE-2001-1406?
There are no effective workarounds for CVE-2001-1406; updating to a fixed version is the recommended approach.