Executive Summary

Informations
NameCVE-2011-2978First vendor Publication2011-08-09
VendorCveLast vendor Modification2011-10-25

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:P/A:N)
Cvss Base Score5Attack RangeNetwork
Cvss Impact Score2.9Attack ComplexityLow
Cvss Expoit Score10AuthentificationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

Bugzilla 2.16rc1 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 does not prevent changes to the confirmation e-mail address (aka old_email field) for e-mail change notifications, which makes it easier for remote attackers to perform arbitrary address changes by leveraging an unattended workstation.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2978

CWE : Common Weakness Enumeration

idName
CWE-20Improper Input Validation

CPE : Common Platform Enumeration

TypeDescriptionCount
Application129

Open Source Vulnerability Database (OSVDB)

idDescription
74301Bugzilla Account Email Change Notification Weakness

Internal Sources (Detail)

SourceUrl
BIDhttp://www.securityfocus.com/bid/49042
CONFIRMhttp://www.bugzilla.org/security/3.4.11/
https://bugzilla.mozilla.org/show_bug.cgi?id=670868
DEBIANhttp://www.debian.org/security/2011/dsa-2322
OSVDBhttp://www.osvdb.org/74301
SECUNIAhttp://secunia.com/advisories/45501
XFhttp://xforce.iss.net/xforce/xfdb/69036

Alert History

If you want to see full details history, please login or register.
0
DateInformations
2013-05-10 23:04:52
  • Multiple Updates