Unscored CVE-2004-1633 EUVD-2004-1627GHSA-57h3-4hgq-6hc9

process_bug.cgi in Bugzilla 2.9 through 2.18rc2 and 2.19 from CVS does not check edit permissions on the keywords field, which allows remot…

Published Feb 20, 2005 · Updated Aug 8, 2024 · Assigned by mitre

Description

process_bug.cgi in Bugzilla 2.9 through 2.18rc2 and 2.19 from CVS does not check edit permissions on the keywords field, which allows remote authenticated users to modify the keywords in a bug via the keywordaction parameter.

References

20041025 [BUGZILLA] Vulnerabilities in Bugzilla 2.16.6 and 2.18rc2 mailing-list
bugzilla-bug-change(17840) vdb-entry
https://bugzilla.mozilla.org/show_bug.cgi?id=252638