CVE-2003-0012 Misconfiguration in n/a

Low 2.1 Published 1 Sep 2004 Updated 8 Aug 2024

Local attackers can modify or delete mining data due to world-writable permissions in the Bugzilla data collection script.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2003-0012?

CVE-2003-0012 is a low-severity vulnerability in Mozilla Bugzilla, published on 1 Sep 2004. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The data collection script for Bugzilla 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 sets world-writable permissions for the data/mining directory when it runs, which allows local users to modify or delete the data.

Which versions are affected by CVE-2003-0012?

It affects 1 product.

Products include Mozilla Bugzilla.

How do I fix CVE-2003-0012?

Upgrade to a fixed version.

Is CVE-2003-0012 being exploited?

There is no known exploitation of CVE-2003-0012 in the wild and no public exploit code.

All Mozilla Bugzilla vulnerabilities

Sources

Also known as GHSA-6q37-rgr4-xxpf.