CVE-2005-1564

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-05-12 · updated 2026-06-16

Description

post_bug.cgi in Bugzilla 2.10 through 2.18, 2.19.1, and 2.19.2 allows remote authenticated users to "enter bugs into products that are closed for bug entry" by modifying the URL to specify the name of the product.

Affected products

Mozilla Bugzilla: 2.10, 2.12, 2.14, 2.14.1, 2.14.2, 2.14.3 (+19)

References

http://marc.info/?l=bugtraq&m=111592031902962&w=2
http://secunia.com/advisories/15338
http://www.bugzilla.org/security/2.16.8/
http://www.osvdb.org/16426
https://bugzilla.mozilla.org/show_bug.cgi?id=287109
https://exchange.xforce.ibmcloud.com/vulnerabilities/42797
http://marc.info/?l=bugtraq&m=111592031902962&w=2
http://secunia.com/advisories/15338
http://www.bugzilla.org/security/2.16.8/
http://www.osvdb.org/16426
https://bugzilla.mozilla.org/show_bug.cgi?id=287109
https://exchange.xforce.ibmcloud.com/vulnerabilities/42797

Get alerted when CVE-2005-1564 or the next vulnerability affects your stack