CVE-2004-0707: SQL Injection
Published Jul 21, 2004
·Updated
SQL injection vulnerability in editusers.cgi in Bugzilla 2.16.x before 2.16.6, and 2.18 before 2.18rc1, allows remote attackers with privileges to grant membership to any group to execute arbitrary SQL.
Affected Software
24 affected components
Bugzilla=2.17.6
Bugzilla=2.16.1
Bugzilla=2.16.2
Bugzilla=2.17.4
Bugzilla=2.10
Bugzilla=2.17.1
Bugzilla=2.16
Bugzilla=2.14.2
Bugzilla=2.14.3
Bugzilla=2.14.4
Bugzilla=2.6
Bugzilla=2.17.5
Bugzilla=2.17.3
Bugzilla=2.4
Bugzilla=2.16.4
Bugzilla=2.12
Bugzilla=2.8
Bugzilla=2.16.3
Bugzilla=2.14.5
Bugzilla=2.17.7
Bugzilla=2.17
Bugzilla=2.14.1
Bugzilla=2.16.5
Bugzilla=2.14
Remediation
Patch Available
Event History
Jul 21, 2004
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-0707?
CVE-2004-0707 is considered a high severity vulnerability due to the potential for remote SQL injection attacks.
2
How do I fix CVE-2004-0707?
To fix CVE-2004-0707, update Bugzilla to version 2.16.6 or 2.18rc1 or later.
3
Which versions of Bugzilla are affected by CVE-2004-0707?
Bugzilla versions 2.16.x before 2.16.6 and 2.18 before 2.18rc1 are affected by CVE-2004-0707.
4
Can CVE-2004-0707 be exploited by anyone?
CVE-2004-0707 can be exploited by remote attackers with privileges to grant membership to any group.
5
What kind of attack can CVE-2004-0707 facilitate?
CVE-2004-0707 can facilitate arbitrary SQL execution due to the SQL injection vulnerability in Bugzilla.