The offer_account_by_email function in User.pm in the WebService for Bugzilla before 3.0.2, and 3.1.x before 3.1.2, does not check the value of the createemailregexp parameter, which allows remote attackers to bypass intended restrictions on account creation.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://fedoranews.org/updates/FEDORA-2007-229.shtml | vendor-advisory x_refsource_FEDORA |
| https://bugzilla.mozilla.org/show_bug.cgi?id=395632 | x_refsource_CONFIRM |
| http://www.vupen.com/english/advisories/2007/3200 | vdb-entry x_refsource_VUPEN |
| http://www.securityfocus.com/archive/1/480077/100/0/threaded | mailing-list x_refsource_BUGTRAQ |
| https://bugzilla.redhat.com/show_bug.cgi?id=299981 | x_refsource_CONFIRM |
| http://secunia.com/advisories/26969 | third-party-advisory x_refsource_SECUNIA |
| http://www.securitytracker.com/id?1018719 | vdb-entry x_refsource_SECTRACK |
| http://secunia.com/advisories/26848 | third-party-advisory x_refsource_SECUNIA |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/36692 | vdb-entry x_refsource_XF |
| http://www.securityfocus.com/bid/25725 | vdb-entry x_refsource_BID |
| http://www.bugzilla.org/security/3.0.1/ | x_refsource_CONFIRM |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://fedoranews.org/updates/FEDORA-2007-229.shtml | vendor-advisory x_refsource_FEDORA x_transferred |
| https://bugzilla.mozilla.org/show_bug.cgi?id=395632 | x_refsource_CONFIRM x_transferred |
| http://www.vupen.com/english/advisories/2007/3200 | vdb-entry x_refsource_VUPEN x_transferred |
| http://www.securityfocus.com/archive/1/480077/100/0/threaded | mailing-list x_refsource_BUGTRAQ x_transferred |
| https://bugzilla.redhat.com/show_bug.cgi?id=299981 | x_refsource_CONFIRM x_transferred |
| http://secunia.com/advisories/26969 | third-party-advisory x_refsource_SECUNIA x_transferred |
| http://www.securitytracker.com/id?1018719 | vdb-entry x_refsource_SECTRACK x_transferred |
| http://secunia.com/advisories/26848 | third-party-advisory x_refsource_SECUNIA x_transferred |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/36692 | vdb-entry x_refsource_XF x_transferred |
| http://www.securityfocus.com/bid/25725 | vdb-entry x_refsource_BID x_transferred |
| http://www.bugzilla.org/security/3.0.1/ | x_refsource_CONFIRM x_transferred |