CVE-2011-2978

UNKNOWN

Bugzilla 2

Published Aug 9, 2011

Modified 1 years ago

Details

Bugzilla 2.16rc1 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 does not prevent changes to the confirmation e-mail address (aka old_email field) for e-mail change notifications, which makes it easier for remote attackers to perform arbitrary address changes by leveraging an unattended workstation.

References

ADVISORYhttp://secunia.com/advisories/45501 WEBhttp://www.bugzilla.org/security/3.4.11/ADVISORYhttp://www.debian.org/security/2011/dsa-2322 WEBhttp://www.osvdb.org/74301 WEBhttp://www.securityfocus.com/bid/49042 WEBhttps://bugzilla.mozilla.org/show_bug.cgi?id=670868 WEBhttps://exchange.xforce.ibmcloud.com/vulnerabilities/69036 ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2011-2978

CVSS Analysis

CVSS v2.0

5.0

Exploitability

Access Vector

NetworkAV:N

Access Complexity

LowAC:L

Authentication

NoneAu:N

Impact

Confidentiality

NoneC:N

Integrity

PartialI:P

Availability

NoneA:N

5/AV:N/AC:L/Au:N/C:N/I:P/A:N

Ecosystems

Timeline

PublishedAug 9, 2011

ModifiedAug 6, 2024

CVE-2011-2978 | Mondoo Vulnerability Intelligence