CVE-2002-0809 Missing authorization in n/a

What is CVE-2002-0809?

CVE-2002-0809 is a high-severity missing authorization vulnerability in Mozilla Bugzilla, published on 2 Apr 2003. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, does not properly handle URL-encoded field names that are generated by some browsers, which could cause certain fields to appear to be unset, which has the effect of removing group permissions on bugs when buglist.cgi is provided with the encoded field names.

Which versions are affected by CVE-2002-0809?

It affects 1 product.

Products include Mozilla Bugzilla.

How do I fix CVE-2002-0809?

No fix has been published for CVE-2002-0809 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2002-0809 being exploited?

There is no known exploitation of CVE-2002-0809 in the wild and no public exploit code.

Other vulnerabilities in Mozilla Bugzilla

• CVE-2004-0769 Memory corruption in n/a Critical 10.0
• CVE-2003-1042 SQL injection in n/a Critical 10.0
• CVE-2003-1043 SQL injection in n/a Critical 10.0
• CVE-2002-0007 Auth bypass in n/a Critical 10.0
• CVE-2018-5123 Cross-site request forgery in Bugzilla High 8.8

All Mozilla Bugzilla vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5579-734j-m88m.