CVE-2004-1633: Medium severity Bugzilla vulnerability

Published Oct 25, 2004

Updated

processbug.cgi in Bugzilla 2.9 through 2.18rc2 and 2.19 from CVS does not check edit permissions on the keywords field, which allows remote authenticated users to modify the keywords in a bug via the keywordaction parameter.

Affected Software

25 affected components

Bugzilla=2.17.6

Bugzilla=2.16.1

Bugzilla=2.19

Bugzilla=2.18-rc1

Bugzilla=2.16.2

Bugzilla=2.17.4

Bugzilla=2.10

Bugzilla=2.17.1

Bugzilla=2.16

Bugzilla=2.14.2

Bugzilla=2.14.3

Bugzilla=2.14.4

Bugzilla=2.17.5

Bugzilla=2.17.3

Bugzilla=2.16.4

Bugzilla=2.12

Bugzilla=2.16.3

Bugzilla=2.14.5

Bugzilla=2.17.7

Bugzilla=2.17

Bugzilla=2.9

Bugzilla=2.18-rc2

Bugzilla=2.14.1

Bugzilla=2.16.5

Bugzilla=2.14

Event History

Oct 25, 2004

CVE Published

04:00 AM

Feb 20, 2005

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-1633?

CVE-2004-1633 is considered a moderate severity vulnerability as it allows unauthorized modification of bug keywords by authenticated users.

How do I fix CVE-2004-1633?

To fix CVE-2004-1633, upgrade Bugzilla to a version later than 2.19 or apply the necessary patches provided by the Bugzilla team.

Which versions of Bugzilla are affected by CVE-2004-1633?

CVE-2004-1633 affects Bugzilla versions from 2.9 to 2.18rc2 and certain versions of 2.19.

Can CVE-2004-1633 be exploited remotely?

Yes, CVE-2004-1633 can be exploited remotely by authenticated users who can send malicious requests using the keywordaction parameter.

What are the potential impacts of exploiting CVE-2004-1633?

Exploiting CVE-2004-1633 could lead to unauthorized changes in bug tracking data, causing data integrity issues in the Bugzilla system.