| Package | Affected versions | Patched versions |
|---|---|---|
| bugzilla | = 2.10= 2.12= 2.14= 2.4= 2.6= 2.8 |
process_bug.cgi in Bugzilla before 2.14 does not set the "groupset" bit when a bug is moved between product groups, which will cause the bug to have the old group's restrictions, which might not be as stringent.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free