PT-2014-4225 · Mozilla · Bugzilla
Publicado
2014-10-09
·
Atualizado
2024-06-15
·
CVE-2014-1572
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Bugzilla versions 2.x through 4.0.x before 4.0.15
Bugzilla versions 4.1.x and 4.2.x before 4.2.11
Bugzilla versions 4.3.x and 4.4.x before 4.4.6
Bugzilla versions 4.5.x before 4.5.6
Description
The issue arises from the
confirm create account function in the account-creation feature, which fails to specify a scalar context for the realname parameter. This allows remote attackers to create accounts with unverified e-mail addresses by sending three realname values, with realname=login name as the second value. This can be exploited by selecting an e-mail address with a domain name for which group privileges are automatically granted.Recommendations
For Bugzilla versions 2.x through 4.0.x before 4.0.15, update to version 4.0.15 or later.
For Bugzilla versions 4.1.x and 4.2.x before 4.2.11, update to version 4.2.11 or later.
For Bugzilla versions 4.3.x and 4.4.x before 4.4.6, update to version 4.4.6 or later.
For Bugzilla versions 4.5.x before 4.5.6, update to version 4.5.6 or later.
As a temporary workaround, consider restricting access to the account-creation feature until the issue is resolved.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Bugzilla