CVE-2012-0448

Bugzilla <3.4.14, <3.6.8, <4.0.4, <4.2rc2 - Info Disclosure

Title source: llm

Description

Bugzilla 2.x and 3.x before 3.4.14, 3.5.x and 3.6.x before 3.6.8, 3.7.x and 4.0.x before 4.0.4, and 4.1.x and 4.2.x before 4.2rc2 does not reject non-ASCII characters in e-mail addresses of new user accounts, which makes it easier for remote authenticated users to spoof other user accounts by choosing a similar e-mail address.

References (6)

Core 6

Core References

Vendor Advisory x_refsource_confirm

http://www.bugzilla.org/security/3.4.13/

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/47814

Exploit, Patch x_refsource_confirm

https://bugzilla.mozilla.org/show_bug.cgi?id=714472

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id?1026623

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/51784

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/72877

Scores

EPSS 0.0101

EPSS Percentile 59.2%

Details

CWE

CWE-20

Status published

Products (45)

mozilla/bugzilla 2.0

mozilla/bugzilla 2.2

mozilla/bugzilla 2.4

mozilla/bugzilla 2.6

mozilla/bugzilla 2.8

mozilla/bugzilla 2.9

mozilla/bugzilla 2.10

mozilla/bugzilla 2.12

mozilla/bugzilla 2.14

mozilla/bugzilla 2.14.1

... and 35 more

Published Feb 02, 2012

Tracked Since Feb 18, 2026