post_bug.cgi in Bugzilla 2.10 through 2.18, 2.19.1, and 2.19.2 allows remote authenticated users to "enter bugs into products that are clos…

published 2005-05-12 21 y ago modified 2026-06-16 4 mo ago also EUVD-2005-1567

cvss: 7.5; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.6%; EPSS 1.6% chance of exploitation in 30 days, percentile 75%
public exploits: 0; none known

post_bug.cgi in Bugzilla 2.10 through 2.18, 2.19.1, and 2.19.2 allows remote authenticated users to "enter bugs into products that are closed for bug entry" by modifying the URL to specify the name of the product.

Patch / fix

links 4

bugzilla.org/security/2.16.8/ advisory
bugzilla.mozilla.org/show_bug.cgi?id=287109 advisory
osvdb.org/16426 advisory
secunia.com/advisories/15338 advisory

Exploit prediction

1.56% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

bugzilla.org http://www.bugzilla.org/security/2.16.8/ referenced PoC, tagged "exploit" by a source, unverified
bugzilla.mozilla.org https://bugzilla.mozilla.org/show_bug.cgi?id=287109 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

References

bugzilla.org /security/2.16.8/
exploit, patch, vendor-advisory
bugzilla.mozilla.org /show_bug.cgi?id=287109
exploit, patch, vendor-advisory
osvdb.org /16426
vdb-entry, patch, vendor-advisory
secunia.com /advisories/15338
third-party-advisory, patch, vendor-advisory
marc.info /?l=bugtraq&m=111592031902962&w=2
mailing-list
exchange.xforce.ibmcloud.com /vulnerabilities/42797
vdb-entry

Sources

CVE List CVE-2005-1564
NVD CVE-2005-1564

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary