CVE-2001-1401

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Bugzilla before 2.14 does not properly restrict access to confidential bugs, which could allow Bugzilla users to bypass viewing permissions via modified bug id parameters in (1) process_bug.cgi, (2) show_activity.cgi, (3) showvotes.cgi, (4) showdependencytree.cgi, (5) showdependencygraph.cgi, (6) showattachment.cgi, or (7) describecomponents.cgi.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

Timeline

Published: Sep 10, 2001
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2001

CVE-2001-14027.5Bugzilla before 2.14 does not properly escape untrusted parameters, which could allow remote attackers to conduct unauthorized activities vi CVE-2001-14037.5Bugzilla before 2.14 includes the username and password in URLs, which could allow attackers to gain privileges by reading the information f CVE-2001-14047.5Bugzilla before 2.14 stores user passwords in plaintext and sends password requests in an email message, which could allow attackers to gain CVE-2001-14052.1Bugzilla before 2.14 does not restrict access to sanitycheck.cgi, which allows local users to cause a denial of service (CPU consumption) vi CVE-2001-14062.1process_bug.cgi in Bugzilla before 2.14 does not set the "groupset" bit when a bug is moved between product groups, which will cause the bug CVE-2001-14077.5Bugzilla before 2.14 allows Bugzilla users to bypass group security checks by marking a bug as the duplicate of a restricted bug, which adds CVE-2001-14085.0Directory traversal vulnerability in readmsg.php in WebMail 2.0.1 in Cobalt Qube 3 allows remote attackers to read arbitrary files via a .. CVE-2001-14093.6dexconf in XFree86 Xserver 4.1.0-2 creates the /dev/dri directory with insecure permissions (666), which allows local users to replace or cr CVE-2001-14105.0Internet Explorer 6 and earlier allows remote attackers to create chromeless windows using the Javascript window.createPopup method, which c CVE-2001-14117.2Format string vulnerability in gm4 (aka m4) on Mac OS X may allow local users to gain privileges if gm4 is called by setuid programs.CVE-2001-14122.1nidump on MacOS X before 10.3 allows local users to read the encrypted passwords from the password file by specifying passwd as a command li CVE-2001-14137.5Stack-based buffer overflow in the comprexx function for ncompress 4.2.4 and earlier, when used in situations that cross security boundaries