CVE-2003-1046: Mozilla Bugzilla

High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days.

describecomponents.cgi in Bugzilla 2.17.3 and 2.17.4 does not properly verify group membership when bug entry groups are used, which allows remote attackers to list component descriptions for otherwise restricted products.

Affected products

• Mozilla Bugzilla: version 2.4 only; version 2.6 only; version 2.8 only; version 2.10 only; version 2.12 only; version 2.14 only; …

Published 2004-08-18. Last modified 2026-06-16.