CVE-2011-3667: Medium severity bugzilla vulnerability

Published Jan 2, 2012

Updated

The User.offeraccountbyemail WebService method in Bugzilla 2.x and 3.x before 3.4.13, 3.5.x and 3.6.x before 3.6.7, 3.7.x and 4.0.x before 4.0.3, and 4.1.x through 4.1.3, when createemailregexp is not empty, does not properly handle usercancreateaccount settings, which allows remote attackers to create user accounts by leveraging a token contained in an e-mail message.

Affected Software

160 affected components

Bugzilla=3.0.4

Bugzilla=3.0-rc1

Bugzilla=4.1.1

Bugzilla=3.1.3

Bugzilla=2.0

Bugzilla=2.18.6\+

Bugzilla=2.16.8

Bugzilla=3.0.0

Bugzilla=2.22.7

Bugzilla=3.7.2

Bugzilla=3.4.3

Bugzilla=3.3.2

Bugzilla=3.0.1

Bugzilla=2.18.8

Bugzilla=2.17.6

Bugzilla=2.16-rc2

Bugzilla=3.2-rc1

Bugzilla=2.18.5

Bugzilla=2.19.3

Bugzilla=2.20-rc2

Bugzilla=2.18.6

Bugzilla=2.17.2

Bugzilla=2.20-rc1

Bugzilla=2.16.1

Bugzilla=2.20

Bugzilla=2.19

Bugzilla=2.18-rc1

Bugzilla=3.6.1

Bugzilla=3.2.6

Bugzilla=3.1.1

Bugzilla=3.7.1

Bugzilla=3.7

Bugzilla=3.6.0

Bugzilla=3.4.2

Bugzilla=2.16.2

Bugzilla=3.1.2

Bugzilla=3.5.3

Bugzilla=2.16.11

Bugzilla=3.6.3

Bugzilla=3.2.5

Bugzilla=3.3.4

Bugzilla=2.20.5

Bugzilla=2.20.6

Bugzilla=4.0.1

Bugzilla=2.22.3

Bugzilla=3.6

Bugzilla=2.22.6

Bugzilla=2.17.4

Bugzilla=4.0-rc2

Bugzilla=2.16-rc1

Bugzilla=2.23.2

Bugzilla=2.21.2

Bugzilla=3.6.4

Bugzilla=3.2.9

Bugzilla=2.10

Bugzilla=3.2.10

Bugzilla=4.1

Bugzilla=2.17.1

Bugzilla=3.2.3

Bugzilla=2.16

Bugzilla=2.22.1

Bugzilla=4.0.2

Bugzilla=2.23.4

Bugzilla=3.5.2

Bugzilla=2.16.9

Bugzilla=3.4.9

Bugzilla=3.0

Bugzilla=3.5.1

Bugzilla=3.0.11

Bugzilla=3.0.6

Bugzilla=3.5

Bugzilla=2.20.1

Bugzilla=2.23.3

Bugzilla=2.14.2

Bugzilla=3.0.7

Bugzilla=3.2.8

Bugzilla=2.18.7

Bugzilla=2.23.1

Bugzilla=2.22.2

Bugzilla=2.18.1

Bugzilla=2.22-rc1

Bugzilla=2.14.3

Bugzilla=2.22.5

Bugzilla=3.4.1

Bugzilla=3.4.10

Bugzilla=3.4.4

Bugzilla=3.6-rc1

Bugzilla=2.14.4

Bugzilla=3.4.8

Bugzilla=2.19.1

Bugzilla=2.16.7

Bugzilla=2.6

Bugzilla=3.4.7

Bugzilla=3.1.4

Bugzilla=2.17.5

Bugzilla=4.1.2

Bugzilla=2.22

Bugzilla=3.1.0

Bugzilla=2.17.3

Bugzilla=2.4

Bugzilla=3.6.7

Bugzilla=2.16.4

Bugzilla=2.12

Bugzilla=2.21.2-rc1

Bugzilla=3.0.3

Bugzilla=3.2

Bugzilla=2.20.3

Bugzilla=3.0.9

Bugzilla=3.4.11

Bugzilla=2.8

Bugzilla=3.2.4

Bugzilla=2.2

Bugzilla=3.0.2

Bugzilla=3.7.3

Bugzilla=3.3.3

Bugzilla=2.18.4

Bugzilla=3.2.2

Bugzilla=2.16.3

Bugzilla=3.6.6

Bugzilla=2.14.5

Bugzilla=2.18.9

Bugzilla=3.3

Bugzilla=2.18

Bugzilla=3.4.12

Bugzilla=2.18.3

Bugzilla=2.17.7

Bugzilla=3.0.10

Bugzilla=2.20.7

Bugzilla=3.4

Bugzilla=4.0-rc1

Bugzilla=3.0.8

Bugzilla=2.20.2

Bugzilla=2.20.4

Bugzilla=2.21.1

Bugzilla=2.18-rc3

Bugzilla=2.17

Bugzilla=2.23

Bugzilla=2.16.6

Bugzilla=3.2.7

Bugzilla=2.9

Bugzilla=2.18.2

Bugzilla=2.18-rc2

Bugzilla=3.4.5

Bugzilla=3.2-rc2

Bugzilla=3.6.5

Bugzilla=3.4-rc1

Bugzilla=3.0.5

Bugzilla=4.1.3

Bugzilla=2.14.1

Bugzilla=2.22.4

Bugzilla=2.21

Bugzilla=3.2.1

Bugzilla=2.16.5

Bugzilla=3.3.1

Bugzilla=3.4.6

Bugzilla=3.6.2

Bugzilla=2.14

Bugzilla=4.0

Bugzilla=2.19.2

Bugzilla=2.16.10

Event History

Jan 2, 2012

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2011-3667?

CVE-2011-3667 is considered a high severity vulnerability due to its potential to allow unauthorized account creation.

How do I fix CVE-2011-3667?

To fix CVE-2011-3667, upgrade Bugzilla to the latest version, specifically to 3.4.13 or later.

What software versions are affected by CVE-2011-3667?

CVE-2011-3667 affects Bugzilla versions 2.x, 3.x before 3.4.13, and several versions up to 4.1.3.

What type of vulnerability is CVE-2011-3667?

CVE-2011-3667 is an account creation vulnerability that can be exploited by remote attackers.

Who is impacted by CVE-2011-3667?

Any users or organizations running affected versions of Bugzilla are impacted by CVE-2011-3667.