CVE-2003-1046

Summary

describecomponents.cgi in Bugzilla 2.17.3 and 2.17.4 does not properly verify group membership when bug entry groups are used, which allows remote attackers to list component descriptions for otherwise restricted products.

Impact & exploitability

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products we track (1)

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Official patch: http://www.securityfocus.com/bid/8953 ↗

Additional information

• NVD record
• http://www.securityfocus.com/bid/8953Patch
• http://bugzilla.mozilla.org/show_bug.cgi?id=209742
• http://www.securityfocus.com/archive/1/343185
• https://exchange.xforce.ibmcloud.com/vulnerabilities/13602