{"api_version":"1","generated_at":"2026-07-23T04:24:07+00:00","cve":"CVE-2002-1196","urls":{"html":"https://cve.report/CVE-2002-1196","api":"https://cve.report/api/cve/CVE-2002-1196.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2002-1196","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2002-1196"},"summary":{"title":"CVE-2002-1196","description":"editproducts.cgi in Bugzilla 2.14.x before 2.14.4, and 2.16.x before 2.16.1, when the \"usebuggroups\" feature is enabled and more than 47 groups are specified, does not properly calculate bit values for large numbers, which grants extra permissions to users via known features of Perl math that set multiple bits.","state":"PUBLISHED","assigner":"mitre","published_at":"2002-10-28 05:00:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://marc.info/?l=bugtraq&m=103349804226566&w=2","name":"http://marc.info/?l=bugtraq&m=103349804226566&w=2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"'[BUGZILLA] Security Advisory' - MARC","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://bugzilla.mozilla.org/show_bug.cgi?id=167485#c12","name":"http://bugzilla.mozilla.org/show_bug.cgi?id=167485#c12","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"167485 - When \"usebuggroups\" is on, then assigning of group_id is in error","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/5843","name":"http://www.securityfocus.com/bid/5843","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Bugzilla Group Creation With Elevated Privileges Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.debian.org/security/2002/dsa-173","name":"http://www.debian.org/security/2002/dsa-173","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Debian -- Security Information -- DSA-173-1 bugzilla","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.iss.net/security_center/static/10233.php","name":"http://www.iss.net/security_center/static/10233.php","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"ISS X-Force Database: bugzilla-usebuggroups-permissions-leak (10233): Bugzilla editproducts.cgi \"usebuggroups\" permissions leak","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2002-1196","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2002-1196","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2002","cve_id":"1196","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"bugzilla","cpe6":"2.14","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2002","cve_id":"1196","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"bugzilla","cpe6":"2.14.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2002","cve_id":"1196","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"bugzilla","cpe6":"2.14.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2002","cve_id":"1196","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"bugzilla","cpe6":"2.14.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2002","cve_id":"1196","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"bugzilla","cpe6":"2.16","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-08T03:19:27.828Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"5843","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/5843"},{"name":"DSA-173","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2002/dsa-173"},{"name":"bugzilla-usebuggroups-permissions-leak(10233)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"http://www.iss.net/security_center/static/10233.php"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://bugzilla.mozilla.org/show_bug.cgi?id=167485#c12"},{"name":"20021001 [BUGZILLA] Security Advisory","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://marc.info/?l=bugtraq&m=103349804226566&w=2"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2002-10-01T00:00:00.000Z","descriptions":[{"lang":"en","value":"editproducts.cgi in Bugzilla 2.14.x before 2.14.4, and 2.16.x before 2.16.1, when the \"usebuggroups\" feature is enabled and more than 47 groups are specified, does not properly calculate bit values for large numbers, which grants extra permissions to users via known features of Perl math that set multiple bits."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2007-10-16T00:00:00.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"5843","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/5843"},{"name":"DSA-173","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2002/dsa-173"},{"name":"bugzilla-usebuggroups-permissions-leak(10233)","tags":["vdb-entry","x_refsource_XF"],"url":"http://www.iss.net/security_center/static/10233.php"},{"tags":["x_refsource_CONFIRM"],"url":"http://bugzilla.mozilla.org/show_bug.cgi?id=167485#c12"},{"name":"20021001 [BUGZILLA] Security Advisory","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://marc.info/?l=bugtraq&m=103349804226566&w=2"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2002-1196","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"editproducts.cgi in Bugzilla 2.14.x before 2.14.4, and 2.16.x before 2.16.1, when the \"usebuggroups\" feature is enabled and more than 47 groups are specified, does not properly calculate bit values for large numbers, which grants extra permissions to users via known features of Perl math that set multiple bits."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"5843","refsource":"BID","url":"http://www.securityfocus.com/bid/5843"},{"name":"DSA-173","refsource":"DEBIAN","url":"http://www.debian.org/security/2002/dsa-173"},{"name":"bugzilla-usebuggroups-permissions-leak(10233)","refsource":"XF","url":"http://www.iss.net/security_center/static/10233.php"},{"name":"http://bugzilla.mozilla.org/show_bug.cgi?id=167485#c12","refsource":"CONFIRM","url":"http://bugzilla.mozilla.org/show_bug.cgi?id=167485#c12"},{"name":"20021001 [BUGZILLA] Security Advisory","refsource":"BUGTRAQ","url":"http://marc.info/?l=bugtraq&m=103349804226566&w=2"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2002-1196","datePublished":"2004-09-01T04:00:00.000Z","dateReserved":"2002-10-09T00:00:00.000Z","dateUpdated":"2024-08-08T03:19:27.828Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2002-10-28 05:00:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:bugzilla:2.14:*:*:*:*:*:*:*","matchCriteriaId":"1883A98C-E595-4F3C-87BF-A63393F9F561"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:bugzilla:2.14.1:*:*:*:*:*:*:*","matchCriteriaId":"DD49E53A-5676-4FAC-A8A2-30FAC04C33D7"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:bugzilla:2.14.2:*:*:*:*:*:*:*","matchCriteriaId":"1084AF8E-5269-4EFF-BBD2-C5A77945FCF2"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:bugzilla:2.14.3:*:*:*:*:*:*:*","matchCriteriaId":"D9A4B035-B73E-48E9-BBB9-83219F5D2A95"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:bugzilla:2.16:*:*:*:*:*:*:*","matchCriteriaId":"F16D338E-C5BC-46E1-95DD-D9B0E25EE56E"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2002","CveId":"1196","Ordinal":"1","Title":"CVE-2002-1196","CVE":"CVE-2002-1196","Year":"2002"},"notes":[{"CveYear":"2002","CveId":"1196","Ordinal":"1","NoteData":"editproducts.cgi in Bugzilla 2.14.x before 2.14.4, and 2.16.x before 2.16.1, when the \"usebuggroups\" feature is enabled and more than 47 groups are specified, does not properly calculate bit values for large numbers, which grants extra permissions to users via known features of Perl math that set multiple bits.","Type":"Description","Title":"CVE-2002-1196"},{"CveYear":"2002","CveId":"1196","Ordinal":"2","NoteData":"2004-09-01","Type":"Other","Title":"Published"},{"CveYear":"2002","CveId":"1196","Ordinal":"3","NoteData":"2007-10-15","Type":"Other","Title":"Modified"}]}}}