Strix
26.1K

CVE-2002-0010

UnknownEPSS 2.28%

Last modified

CVE-2002-0010 is a vulnerability of currently unknown severity. Bugzilla before 2.14.1 allows remote attackers to inject arbitrary SQL code and create files or gain privileges via (1) the sql parameter in buglist.cgi, (2) invalid field names from the "boolean chart" query in buglist.cgi, (3) the mybugslink parameter in userprefs.cgi, (4) a malformed bug ID in the buglist parameter in long_list.cgi, and (5) the value parameter in editusers.cgi, which allows groupset privileges to be modified by attackers with blessgroupset privileges.. EPSS estimates a 2.28% chance of exploitation in the next 30 days.

Description

Bugzilla before 2.14.1 allows remote attackers to inject arbitrary SQL code and create files or gain privileges via (1) the sql parameter in buglist.cgi, (2) invalid field names from the "boolean chart" query in buglist.cgi, (3) the mybugslink parameter in userprefs.cgi, (4) a malformed bug ID in the buglist parameter in long_list.cgi, and (5) the value parameter in editusers.cgi, which allows groupset privileges to be modified by attackers with blessgroupset privileges.

Metrics

EPSS Probability
2.28%

80.9th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersions
MozillaBugzilla<= 2.14.1

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2002-0010?
Bugzilla before 2.14.1 allows remote attackers to inject arbitrary SQL code and create files or gain privileges via (1) the sql parameter in buglist.cgi, (2) invalid field names from the "boolean chart" query in buglist.cgi, (3) the mybugslink parameter in userprefs.cgi, (4) a malformed bug ID in the buglist parameter in long_list.cgi, and (5) the value parameter in editusers.cgi, which allows groupset privileges to be modified by attackers with blessgroupset privileges.
How severe is CVE-2002-0010?
Severity scoring for CVE-2002-0010 is pending analysis. The EPSS model estimates a 2.28% probability of exploitation in the next 30 days.
How do I fix CVE-2002-0010?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2002-0010?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST