CVE-2002-1196 json
editproducts.cgi in Bugzilla 2.14.x before 2.14.4, and 2.16.x before 2.16.1, when the "usebuggroups" feature is enabled and more than 47 gr…
published 2002-10-28 24 y ago modified 2026-06-16 4 mo ago also EUVD-2002-1180
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 75%
- public exploits
- 0
- none known
Summary
editproducts.cgi in Bugzilla 2.14.x before 2.14.4, and 2.16.x before 2.16.1, when the "usebuggroups" feature is enabled and more than 47 groups are specified, does not properly calculate bit values for large numbers, which grants extra permissions to users via known features of Perl math that set multiple bits.
Patch / fix
- debian.org/security/2002/dsa-173 advisory
Exploit prediction
1.59% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
-
debian.org
/security/2002/dsa-173
vendor-advisory, patch
-
iss.net
/security_center/static/10233.php
vdb-entry, vendor-advisory
-
securityfocus.com
/bid/5843
vdb-entry
- bugzilla.mozilla.org /show_bug.cgi?id=167485#c12
-
marc.info
/?l=bugtraq&m=103349804226566&w=2
mailing-list
Sources
- CVE List CVE-2002-1196
- NVD CVE-2002-1196
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.