CVE-2002-1196
Severity Score
7.5
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
editproducts.cgi in Bugzilla 2.14.x before 2.14.4, and 2.16.x before 2.16.1, when the "usebuggroups" feature is enabled and more than 47 groups are specified, does not properly calculate bit values for large numbers, which grants extra permissions to users via known features of Perl math that set multiple bits.
editproducts.cgi en Bugzilla 2.14.x anteriores a 2.14.4 y 2.16 anteriores a 2.16.1, cuando la característica "usebuggroups" está activada y se especifican más de 47 grupos, no calcula adecuadamente valores de bits de números grandes, lo que permite permisos extra a usuarios mediante características conocidas de funciones matemáticas de Perl que establecen múltiples bits.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2002-10-09 CVE Reserved
- 2002-10-28 CVE Published
- 2024-03-09 EPSS Updated
- 2024-08-08 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| http://bugzilla.mozilla.org/show_bug.cgi?id=167485#c12 | X_refsource_confirm | |
| http://marc.info/?l=bugtraq&m=103349804226566&w=2 | Mailing List | |
| http://www.securityfocus.com/bid/5843 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.debian.org/security/2002/dsa-173 | 2016-10-18 |
| URL | Date | SRC |
|---|---|---|
| http://www.iss.net/security_center/static/10233.php | 2016-10-18 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Mozilla Search vendor "Mozilla" | Bugzilla Search vendor "Mozilla" for product "Bugzilla" | 2.14 Search vendor "Mozilla" for product "Bugzilla" and version "2.14" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Bugzilla Search vendor "Mozilla" for product "Bugzilla" | 2.14.1 Search vendor "Mozilla" for product "Bugzilla" and version "2.14.1" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Bugzilla Search vendor "Mozilla" for product "Bugzilla" | 2.14.2 Search vendor "Mozilla" for product "Bugzilla" and version "2.14.2" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Bugzilla Search vendor "Mozilla" for product "Bugzilla" | 2.14.3 Search vendor "Mozilla" for product "Bugzilla" and version "2.14.3" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Bugzilla Search vendor "Mozilla" for product "Bugzilla" | 2.16 Search vendor "Mozilla" for product "Bugzilla" and version "2.16" | - |
Affected
| ||||||