CVE-2002-0810: Medium severity Bugzilla vulnerability

Published Aug 12, 2002

Updated

Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, directs error messages from the syncshadowdb command to the HTML output, which could leak sensitive information, including plaintext passwords, if syncshadowdb fails.

Affected Software

4 affected components

Bugzilla=2.14

Bugzilla=2.14.1

Bugzilla=2.16

Bugzilla=2.16-rc1

Remediation

Patch Available

http://archives.neohapsis.com/archives/bugtraq/2002-06/0054.html

Event History

Aug 12, 2002

CVE Published

04:00 AM

Apr 2, 2003

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2002-0810?

CVE-2002-0810 is classified as a medium severity vulnerability due to the potential exposure of sensitive information.

How do I fix CVE-2002-0810?

To fix CVE-2002-0810, upgrade Bugzilla to version 2.14.2 or later for version 2.14, or to version 2.16rc2 or later for version 2.16.

What types of information can be leaked due to CVE-2002-0810?

CVE-2002-0810 can leak sensitive information including plaintext passwords from error messages.

Which versions of Bugzilla are affected by CVE-2002-0810?

CVE-2002-0810 affects Bugzilla versions 2.14 before 2.14.2 and 2.16 before 2.16rc2.

How does CVE-2002-0810 exploit the syncshadowdb command?

CVE-2002-0810 exploits the syncshadowdb command by directing error messages to HTML output, risking sensitive data exposure.