CVE-2003-0013

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2003-01-17 · updated 2026-06-16

Description

The default .htaccess scripts for Bugzilla 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 do not include filenames for backup copies of the localconfig file that are made from editors such as vi and Emacs, which could allow remote attackers to obtain a database password by directly accessing the backup file.

Affected products

Mozilla Bugzilla: 2.14, 2.14.1, 2.14.2, 2.14.3, 2.14.4, 2.16 (+3)

References

http://marc.info/?l=bugtraq&m=104154319200399&w=2
http://www.debian.org/security/2003/dsa-230
http://www.iss.net/security_center/static/10970.php
http://www.osvdb.org/6351
http://www.securityfocus.com/bid/6501
http://marc.info/?l=bugtraq&m=104154319200399&w=2
http://www.debian.org/security/2003/dsa-230
http://www.iss.net/security_center/static/10970.php
http://www.osvdb.org/6351
http://www.securityfocus.com/bid/6501

Get alerted when CVE-2003-0013 or the next vulnerability affects your stack