CVE-2003-1044

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2004-08-18 · updated 2026-06-16

Description

editproducts.cgi in Bugzilla 2.16.3 and earlier, when usebuggroups is enabled, does not properly remove group add privileges from a group that is being deleted, which allows users with those privileges to perform unauthorized additions to the next group that is assigned with the original group ID.

Affected products

Mozilla Bugzilla: 2.4, 2.6, 2.8, 2.10, 2.12, 2.14 (+12)

References

http://bugzilla.mozilla.org/show_bug.cgi?id=219690
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000774
http://www.securityfocus.com/archive/1/343185
http://www.securityfocus.com/bid/8953
https://exchange.xforce.ibmcloud.com/vulnerabilities/13597
http://bugzilla.mozilla.org/show_bug.cgi?id=219690
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000774
http://www.securityfocus.com/archive/1/343185
http://www.securityfocus.com/bid/8953
https://exchange.xforce.ibmcloud.com/vulnerabilities/13597

Get alerted when CVE-2003-1044 or the next vulnerability affects your stack