CVE-2011-2978

Bugzilla Multiple Versions - Unauthenticated Email Address Change

Title source: llm
STIX 2.1

Description

Bugzilla 2.16rc1 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 does not prevent changes to the confirmation e-mail address (aka old_email field) for e-mail change notifications, which makes it easier for remote attackers to perform arbitrary address changes by leveraging an unattended workstation.

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/69036
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/74301
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/45501
Vendor Advisory x_refsource_confirm
http://www.bugzilla.org/security/3.4.11/
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2011/dsa-2322
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/49042

Scores

EPSS 0.0171
EPSS Percentile 74.7%

Details

CWE
CWE-20
Status published
Products (43)
mozilla/bugzilla 2.16 (2 CPE variants)
mozilla/bugzilla 2.16.1
mozilla/bugzilla 2.16.2
mozilla/bugzilla 2.16.3
mozilla/bugzilla 2.16.4
mozilla/bugzilla 2.16.5
mozilla/bugzilla 2.16.6
mozilla/bugzilla 2.16.7
mozilla/bugzilla 2.16.8
mozilla/bugzilla 2.16.9
... and 33 more
Published Aug 09, 2011
Tracked Since Feb 18, 2026