| Vulnerability Name: | CVE-2001-0329 (CCN-6488) | ||||||||
| Assigned: | 2001-04-30 | ||||||||
| Published: | 2001-04-30 | ||||||||
| Updated: | 2008-09-10 | ||||||||
| Summary: | Bugzilla 2.10 allows remote attackers to execute arbitrary commands via shell metacharacters in a username that is then processed by (1) the Bugzilla_login cookie in post_bug.cgi, or (2) the who parameter in process_bug.cgi. | ||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||
| Vulnerability Type: | CWE-Other | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: MITRE Type: CNA CVE-2001-0329 Source: ATSTAKE Type: Patch, Vendor Advisory A043001-1 Source: CCN Type: Bugzilla Security Advisory Patches To Apply To 2.10 If Not Upgrading To 2.12 Source: CONFIRM Type: UNKNOWN http://www.mozilla.org/projects/bugzilla/security2_12.html Source: CCN Type: OSVDB ID: 6364 Bugzilla post_bug.cgi Bugzilla_login Cookie Arbitrary Command Execution Source: CCN Type: OSVDB ID: 6365 Bugzilla process_bug.cgi who Variable Arbitrary Command Execution Source: CCN Type: OSVDB ID: 6392 Bugzilla createattachment.cgi Bugzilla_login Cookie Arbitrary Command Execution Source: CCN Type: OSVDB ID: 6393 Bugzilla backdoor.cgi Bugzilla_login Cookie Arbitrary Command Execution Source: BID Type: UNKNOWN 1199 Source: CCN Type: BID-1199 Bugzilla Remote Arbitrary Command Execution Vulnerability Source: CCN Type: BID-2670 Bugzilla Remote Arbitrary Command Execution Vulnerability Source: CCN Type: @stake, Inc. Security Advisory A043001-1 Remote Vulnerabilities in Bugzilla Source: XF Type: UNKNOWN bugzilla-email-shell-characters(6488) | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| BACK | |||||||||