CVE-2002-0807
Bugzilla 2.14-2.14.1 and 2.16-2.16rc1 - Cross-Site Scripting via User Full Name Field
Title source: llmDescription
Cross-site scripting vulnerabilities in Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, could allow remote attackers to execute script as other Bugzilla users via the full name (real name) field, which is not properly quoted by editusers.cgi.
References (4)
Core 4
Core References
Third Party Advisory vdb-entry
x_refsource_xf
http://www.iss.net/security_center/static/9304.php
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/4964
Patch, Vendor Advisory mailing-list
x_refsource_bugtraq
http://archives.neohapsis.com/archives/bugtraq/2002-06/0054.html
Issue Tracking x_refsource_confirm
http://bugzilla.mozilla.org/show_bug.cgi?id=146447
Scores
EPSS
0.0130
EPSS Percentile
67.4%
Details
Status
published
Products (3)
mozilla/bugzilla
2.14
mozilla/bugzilla
2.14.1
mozilla/bugzilla
2.16 (2 CPE variants)
Published
Aug 12, 2002
Tracked Since
Feb 18, 2026