CVE-2001-1406
process_bug.cgi in Bugzilla before 2.14 does not set the "groupset" bit when a bug is moved...
process_bug.cgi in Bugzilla before 2.14 does not set the "groupset" bit when a bug is moved between product groups, which will cause the bug to have the old group's restrictions, which might not be as stringent.
Exploit likelihood
What each source reports
NVD Score used
process_bug.cgi in Bugzilla before 2.14 does not set the "groupset" bit when a bug is moved between product groups, which will cause the bug to have the old group's restrictions, which might not be as stringent.
- Record
CVE-2001-1406- CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
process_bug.cgi in Bugzilla before 2.14 does not set the "groupset" bit when a bug is moved between product groups, which will cause the bug to have the old group's restrictions, which might not be as stringent.
- Record
CVE-2001-1406- Updated
- 2026-11-02
EUVDEUVD-2001-1386 No score
process_bug.cgi in Bugzilla before 2.14 does not set the "groupset" bit when a bug is moved between product groups, which will cause the bug to have the old group's restrictions, which might not be as stringent.
- Record
EUVD-2001-1386- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fq54-7wqq-xmv8 No score
process_bug.cgi in Bugzilla before 2.14 does not set the "groupset" bit when a bug is moved...
process_bug.cgi in Bugzilla before 2.14 does not set the "groupset" bit when a bug is moved between product groups, which will cause the bug to have the old group's restrictions, which might not be as stringent.
- Record
GHSA-fq54-7wqq-xmv8- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2001-1406 is a low vulnerability (CVSS 2.1) in Mozilla Bugzilla, published September 10, 2001. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. No source names a fixed version.