CVE-2005-2173
First published: Fri Jul 08 2005(Updated: )
The Flag::validate and Flag::modify functions in Bugzilla 2.17.1 to 2.18.1 and 2.19.1 to 2.19.3 do not verify that the flag ID is appropriate for the given bug or attachment ID, which allows users to change flags on arbitrary bugs and obtain a bug summary via process_bug.cgi.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Bugzilla | =2.17.6 | |
| Mozilla Bugzilla | =2.19.3 | |
| Mozilla Bugzilla | =2.19 | |
| Mozilla Bugzilla | =2.18-rc1 | |
| Mozilla Bugzilla | =2.17.4 | |
| Mozilla Bugzilla | =2.17.1 | |
| Mozilla Bugzilla | =2.18.1 | |
| Mozilla Bugzilla | =2.19.1 | |
| Mozilla Bugzilla | =2.17.5 | |
| Mozilla Bugzilla | =2.17.3 | |
| Mozilla Bugzilla | =2.18 | |
| Mozilla Bugzilla | =2.17.7 | |
| Mozilla Bugzilla | =2.18-rc3 | |
| Mozilla Bugzilla | =2.18-rc2 | |
| Mozilla Bugzilla | =2.19.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2005-2173?
CVE-2005-2173 has a medium severity as it can allow unauthorized users to modify flags on arbitrary bugs.
How do I fix CVE-2005-2173?
To fix CVE-2005-2173, upgrade your Bugzilla installation to version 2.18.2 or later.
Which versions are affected by CVE-2005-2173?
CVE-2005-2173 affects Bugzilla versions 2.17.1 to 2.17.7 and 2.18.1 to 2.19.3.
What type of vulnerability is CVE-2005-2173?
CVE-2005-2173 is a privilege escalation vulnerability related to flag handling in Bugzilla.
What can an attacker do with CVE-2005-2173?
An attacker can change flags on bugs they should not access and view bug summaries through process_bug.cgi.
- collector/nvd-historical
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/remedy
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/weakness
- agent/author
- agent/severity
- agent/tags
- agent/description
- agent/event
- agent/source
- vendor/mozilla
- canonical/mozilla bugzilla
- version/mozilla bugzilla/2.17.6
- version/mozilla bugzilla/2.19.3
- version/mozilla bugzilla/2.19
- version/mozilla bugzilla/2.18-rc1
- version/mozilla bugzilla/2.17.4
- version/mozilla bugzilla/2.17.1
- version/mozilla bugzilla/2.18.1
- version/mozilla bugzilla/2.19.1
- version/mozilla bugzilla/2.17.5
- version/mozilla bugzilla/2.17.3
- version/mozilla bugzilla/2.18
- version/mozilla bugzilla/2.17.7
- version/mozilla bugzilla/2.18-rc3
- version/mozilla bugzilla/2.18-rc2
- version/mozilla bugzilla/2.19.2