CVE-2004-1633: Mozilla Bugzilla

Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days.

process_bug.cgi in Bugzilla 2.9 through 2.18rc2 and 2.19 from CVS does not check edit permissions on the keywords field, which allows remote authenticated users to modify the keywords in a bug via the keywordaction parameter.

Affected products

• Mozilla Bugzilla: version 2.9 only; version 2.10 only; version 2.12 only; version 2.14 only; version 2.14.1 only; version 2.14.2 only; …

Published 2004-10-25. Last modified 2026-06-16.