Home > Vulnerability Database > CVE-2014-1572

Mend.io Vulnerability Database

CVE-2014-1572

Date: October 12, 2014

The confirm_create_account function in the account-creation feature in token.cgi in Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not specify a scalar context for the realname parameter, which allows remote attackers to create accounts with unverified e-mail addresses by sending three realname values with realname=login_name as the second, as demonstrated by selecting an e-mail address with a domain name for which group privileges are automatically granted.

Language: Perl

Severity Score

5.3

Related Resources (16)

Url: http://advisories.mageia.org/MGASA-2014-0412.html

Url: http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141321.html

Url: https://bugzilla.mozilla.org/show_bug.cgi?id=1074812

Url: http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141309.html

Url: http://www.bugzilla.org/security/4.0.14/

Url: https://nvd.nist.gov/vuln/detail/CVE-2014-1572

Url: http://www.securitytracker.com/id/1030978

Url: https://security.gentoo.org/glsa/201607-11

Url: http://www.mandriva.com/security/advisories?name=MDVSA-2014:200

Url: http://lists.fedoraproject.org/pipermail/package-announce/2014-November/142524.html

Url: http://www.opennet.ru/opennews/art.shtml?num=40766

Url: http://packetstormsecurity.com/files/128578/Bugzilla-Account-Creation-XSS-Information-Leak.html

Url: http://www.reddit.com/r/netsec/comments/2ihen0/new_class_of_vulnerability_in_perl_web/

Url: http://blog.gerv.net/2014/10/new-class-of-vulnerability-in-perl-web-applications/

Url: http://openwall.com/lists/oss-security/2014/10/07/20

Url: https://www.mend.io/vulnerability-database/CVE-2014-1572

Severity Score

5.3

Weakness Type (CWE)

Permissions, Privileges, and Access Control

CWE-264

CVSS v3.1

Base Score:	5.3
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	LOW
Availability (A):	NONE

CVSS v2

Base Score:	5.0
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	PARTIAL
Availability (A):	NONE
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2014-1572

Date: October 12, 2014

Language: Perl

Severity Score

Related Resources (16)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?