Vulnerability-Lookup

FKIE_CVE-2003-1046

Vulnerability from fkie_nvd - Published: 2004-08-18 04:00 - Updated: 2026-06-16 22:03

Severity

Summary

describecomponents.cgi in Bugzilla 2.17.3 and 2.17.4 does not properly verify group membership when bug entry groups are used, which allows remote attackers to list component descriptions for otherwise restricted products.

References

URL	Tags
cve@mitre.org	http://bugzilla.mozilla.org/show_bug.cgi?id=209742
cve@mitre.org	http://www.securityfocus.com/archive/1/343185
cve@mitre.org	http://www.securityfocus.com/bid/8953	Patch, Vendor Advisory
cve@mitre.org	https://exchange.xforce.ibmcloud.com/vulnerabilities/13602
af854a3a-2127-422b-91ae-364da2661108	http://bugzilla.mozilla.org/show_bug.cgi?id=209742
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/archive/1/343185
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/8953	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/13602

Impacted products

Vendor	Product	Version
mozilla	bugzilla	2.4
mozilla	bugzilla	2.6
mozilla	bugzilla	2.8
mozilla	bugzilla	2.10
mozilla	bugzilla	2.12
mozilla	bugzilla	2.14
mozilla	bugzilla	2.14.1
mozilla	bugzilla	2.14.2
mozilla	bugzilla	2.14.3
mozilla	bugzilla	2.14.4
mozilla	bugzilla	2.14.5
mozilla	bugzilla	2.16
mozilla	bugzilla	2.16.1
mozilla	bugzilla	2.16.2
mozilla	bugzilla	2.16.3
mozilla	bugzilla	2.17.1
mozilla	bugzilla	2.17.3
mozilla	bugzilla	2.17.4

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:bugzilla:2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "8112FF13-B4CE-4DC7-85B1-C69D975F162B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:bugzilla:2.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "86F5A3CA-E4A6-4E51-AC83-0C8F3E5E2C4E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:bugzilla:2.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "F6E5E379-D475-42F3-B0DC-3D04C1D25566",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:bugzilla:2.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "893741D3-062B-45F9-B5A3-1B81058E7FD7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:bugzilla:2.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "E8D53B5F-6AEE-4192-B838-E1DA92C59285",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:bugzilla:2.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "1883A98C-E595-4F3C-87BF-A63393F9F561",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:bugzilla:2.14.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD49E53A-5676-4FAC-A8A2-30FAC04C33D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:bugzilla:2.14.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "1084AF8E-5269-4EFF-BBD2-C5A77945FCF2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:bugzilla:2.14.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "D9A4B035-B73E-48E9-BBB9-83219F5D2A95",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:bugzilla:2.14.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "9452C271-2812-4775-8396-394C642EACFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:bugzilla:2.14.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "2D351AF2-C0AB-4BB3-8692-677A3025A615",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:bugzilla:2.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "F16D338E-C5BC-46E1-95DD-D9B0E25EE56E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:bugzilla:2.16.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "19F19219-3AFD-4D8E-B02B-BFCBD1BC7C36",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:bugzilla:2.16.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "B900D9A7-913A-4176-90CF-C7C3B09A4261",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:bugzilla:2.16.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "B692910E-633D-4A88-B245-56A2B58DD4CB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:bugzilla:2.17.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "BBCDA64F-C49A-4F5B-B285-4079D8E3A499",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:bugzilla:2.17.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "85ED3457-CC21-4DB3-931F-677F723E1B2A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:bugzilla:2.17.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "6C8711D3-55CF-4131-BBAC-6BE07068219F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "describecomponents.cgi in Bugzilla 2.17.3 and 2.17.4 does not properly verify group membership when bug entry groups are used, which allows remote attackers to list component descriptions for otherwise restricted products."
    },
    {
      "lang": "es",
      "value": "describecomponents.cgi en Bugzilla 2.17.3 y 2.17.4 no verifica adecuadamente la pertenecia a grupos cuando se usan grupos de entrada de bugs , lo que permite a atacantes remotos listar descripciones de componentes de productos en otro caso restringidos."
    }
  ],
  "id": "CVE-2003-1046",
  "lastModified": "2026-06-16T22:03:25.477",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2004-08-18T04:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=209742"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/343185"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.securityfocus.com/bid/8953"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13602"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=209742"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/343185"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.securityfocus.com/bid/8953"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13602"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2003-1046 (GCVE-0-2003-1046)

Vulnerability from cvelistv5 – Published: 2004-06-03 04:00 – Updated: 2024-08-08 02:12

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

4 references

URL	Tags
http://www.securityfocus.com/archive/1/343185	mailing-listx_refsource_BUGTRAQ
http://bugzilla.mozilla.org/show_bug.cgi?id=209742	x_refsource_CONFIRM
http://www.securityfocus.com/bid/8953	vdb-entryx_refsource_BID
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF

Date Public

2003-11-03 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T02:12:35.780Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20031103 [BUGZILLA] Security Advisory - SQL injection, information leak",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/343185"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=209742"
          },
          {
            "name": "8953",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/8953"
          },
          {
            "name": "bugzilla-describecomponents-obtain-info(13602)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13602"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2003-11-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "describecomponents.cgi in Bugzilla 2.17.3 and 2.17.4 does not properly verify group membership when bug entry groups are used, which allows remote attackers to list component descriptions for otherwise restricted products."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-10T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20031103 [BUGZILLA] Security Advisory - SQL injection, information leak",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/343185"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=209742"
        },
        {
          "name": "8953",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/8953"
        },
        {
          "name": "bugzilla-describecomponents-obtain-info(13602)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13602"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2003-1046",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "describecomponents.cgi in Bugzilla 2.17.3 and 2.17.4 does not properly verify group membership when bug entry groups are used, which allows remote attackers to list component descriptions for otherwise restricted products."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20031103 [BUGZILLA] Security Advisory - SQL injection, information leak",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/343185"
            },
            {
              "name": "http://bugzilla.mozilla.org/show_bug.cgi?id=209742",
              "refsource": "CONFIRM",
              "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=209742"
            },
            {
              "name": "8953",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/8953"
            },
            {
              "name": "bugzilla-describecomponents-obtain-info(13602)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13602"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2003-1046",
    "datePublished": "2004-06-03T04:00:00.000Z",
    "dateReserved": "2004-05-27T00:00:00.000Z",
    "dateUpdated": "2024-08-08T02:12:35.780Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.