CVE-2005-2173

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2005-07-08 · updated 2026-06-16

Description

The Flag::validate and Flag::modify functions in Bugzilla 2.17.1 to 2.18.1 and 2.19.1 to 2.19.3 do not verify that the flag ID is appropriate for the given bug or attachment ID, which allows users to change flags on arbitrary bugs and obtain a bug summary via process_bug.cgi.

Affected products

Mozilla Bugzilla: 2.17.1, 2.17.3, 2.17.4, 2.17.5, 2.17.6, 2.17.7 (+9)

References

http://securitytracker.com/id?1014428
http://www.bugzilla.org/security/2.18.1/
https://bugzilla.mozilla.org/show_bug.cgi?id=293159
http://securitytracker.com/id?1014428
http://www.bugzilla.org/security/2.18.1/
https://bugzilla.mozilla.org/show_bug.cgi?id=293159

Get alerted when CVE-2005-2173 or the next vulnerability affects your stack