CVE-2002-0010
Bugzilla before 2.14.1 allows remote attackers to inject arbitrary SQL code and create files or...
CVE-2002-0010 is a high vulnerability (CVSS 7.5) in Mozilla Bugzilla, published January 10, 2002. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.28%, the 83rd percentile. No source names a fixed version.
Bugzilla before 2.14.1 allows remote attackers to inject arbitrary SQL code and create files or gain privileges via (1) the sql parameter in buglist.cgi, (2) invalid field names from the "boolean chart" query in buglist.cgi, (3) the mybugslink parameter in userprefs.cgi, (4) a malformed bug ID in the buglist parameter in long_list.cgi, and (5) the value parameter in editusers.cgi, which allows groupset privileges to be modified by attackers with blessgroupset privileges.
Exploit likelihood
What each source reports
NVD Score used
Bugzilla before 2.14.1 allows remote attackers to inject arbitrary SQL code and create files or gain privileges via (1) the sql parameter in buglist.cgi, (2) invalid field names from the "boolean chart" query in buglist.cgi, (3) the mybugslink parameter in userprefs.cgi, (4) a malformed bug ID in the buglist parameter in long_list.cgi, and (5) the value parameter in editusers.cgi, which allows groupset privileges to be modified by attackers with blessgroupset privileges.
- Record
CVE-2002-0010- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Bugzilla before 2.14.1 allows remote attackers to inject arbitrary SQL code and create files or gain privileges via (1) the sql parameter in buglist.cgi, (2) invalid field names from the "boolean chart" query in buglist.cgi, (3) the mybugslink parameter in userprefs.cgi, (4) a malformed bug ID in the buglist parameter in long_list.cgi, and (5) the value parameter in editusers.cgi, which allows groupset privileges to be modified by attackers with blessgroupset privileges.
- Record
CVE-2002-0010- Updated
- 2026-11-02
EUVDEUVD-2002-0010 No score
Bugzilla before 2.14.1 allows remote attackers to inject arbitrary SQL code and create files or gain privileges via (1) the sql parameter in buglist.cgi, (2) invalid field names from the "boolean chart" query in buglist.cgi, (3) the mybugslink parameter in userprefs.cgi, (4) a malformed bug ID in the buglist parameter in long_list.cgi, and (5) the value parameter in editusers.cgi, which allows groupset privileges to be modified by attackers with blessgroupset privileges.
- Record
EUVD-2002-0010- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c3r4-83qf-6cq7 No score
Bugzilla before 2.14.1 allows remote attackers to inject arbitrary SQL code and create files or...
Bugzilla before 2.14.1 allows remote attackers to inject arbitrary SQL code and create files or gain privileges via (1) the sql parameter in buglist.cgi, (2) invalid field names from the "boolean chart" query in buglist.cgi, (3) the mybugslink parameter in userprefs.cgi, (4) a malformed bug ID in the buglist parameter in long_list.cgi, and (5) the value parameter in editusers.cgi, which allows groupset privileges to be modified by attackers with blessgroupset privileges.
- Record
GHSA-c3r4-83qf-6cq7- Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD |
References
archives.neohapsis.com/archives/bugtraq/2002-01/0052.html
securityfocus.com/bid/3805
iss.net/security_center/static/7811.php
Show 15 moreShow less
bugzilla.mozilla.org/show_bug.cgi?id=108821
rhn.redhat.com/errata/RHSA-2002-001.html
bugzilla.org/bugzilla2.14to2.14.1.patch
nvd.nist.gov/vuln/detail/CVE-2002-0010
github.com/advisories/GHSA-c3r4-83qf-6cq7