CVE-2011-3667
published 2012-01-02CVE-2011-3667: The User.offer_account_by_email WebService method in Bugzilla 2.x and 3.x before 3.4.13, 3.5.x and 3.6.x before 3.6.7, 3.7.x and 4.0.x before 4.0.3, and 4.1.x…
PriorityP431medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
1.07%
61.3th percentile
The User.offer_account_by_email WebService method in Bugzilla 2.x and 3.x before 3.4.13, 3.5.x and 3.6.x before 3.6.7, 3.7.x and 4.0.x before 4.0.3, and 4.1.x through 4.1.3, when createemailregexp is not empty, does not properly handle user_can_create_account settings, which allows remote attackers to create user accounts by leveraging a token contained in an e-mail message.
Affected
144 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2011-3657 CVE-2011-3667 CVE-2011-3668 CVE-2011-3669 bugzilla: multiple security flaws fixed in 4.1.3, 4.0.2, 3.6.6, and 3.4.12 [fedora-all]
bugzilla·2012-01-03·CVSS 4.3
CVE-2011-3657 [MEDIUM] CVE-2011-3657 CVE-2011-3667 CVE-2011-3668 CVE-2011-3669 bugzilla: multiple security flaws fixed in 4.1.3, 4.0.2, 3.6.6, and 3.4.12 [fedora-all]
CVE-2011-3657 CVE-2011-3667 CVE-2011-3668 CVE-2011-3669 bugzilla: multiple security flaws fixed in 4.1.3, 4.0.2, 3.6.6, and 3.4.12 [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submissi
Bugzilla
CVE-2011-3657 CVE-2011-3667 CVE-2011-3668 CVE-2011-3669 bugzilla: multiple security flaws fixed in 4.1.3, 4.0.2, 3.6.6, and 3.4.12 [epel-all]
bugzilla·2012-01-03·CVSS 4.3
CVE-2011-3657 [MEDIUM] CVE-2011-3657 CVE-2011-3667 CVE-2011-3668 CVE-2011-3669 bugzilla: multiple security flaws fixed in 4.1.3, 4.0.2, 3.6.6, and 3.4.12 [epel-all]
CVE-2011-3657 CVE-2011-3667 CVE-2011-3668 CVE-2011-3669 bugzilla: multiple security flaws fixed in 4.1.3, 4.0.2, 3.6.6, and 3.4.12 [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submission
Bugzilla
CVE-2011-3657 CVE-2011-3667 CVE-2011-3668 CVE-2011-3669 bugzilla: multiple security flaws fixed in 4.1.3, 4.0.2, 3.6.6, and 3.4.12
bugzilla·2011-12-29·CVSS 4.3
CVE-2011-3657 [MEDIUM] CVE-2011-3657 CVE-2011-3667 CVE-2011-3668 CVE-2011-3669 bugzilla: multiple security flaws fixed in 4.1.3, 4.0.2, 3.6.6, and 3.4.12
CVE-2011-3657 CVE-2011-3667 CVE-2011-3668 CVE-2011-3669 bugzilla: multiple security flaws fixed in 4.1.3, 4.0.2, 3.6.6, and 3.4.12
http://www.bugzilla.org/security/3.4.12/
Vulnerability Details
Class: Cross-Site Scripting
Versions: 2.17.1 to 3.4.12, 3.5.1 to 3.6.6, 3.7.1 to 4.0.2,
4.1.1 to 4.1.3
Fixed In: 3.4.13, 3.6.7, 4.0.3, 4.2rc1
Description: Tabular and graphical reports, as well as new charts have
a debug mode which displays raw data as plain text. This
text is not correctly escaped and a crafted URL could
use this vulnerability to inject code leading to XSS.
References: https://bugzilla.mozilla.org/show_bug.cgi?id=697699
CVE Number: CVE-2011-3657
Class: Unauthorized Account Creation
Versions: 2.23.3 to 3.4.12, 3.5.1 to 3.6.6, 3.7.1 to 4.0.2,
4.1.1 to 4.1.3
Fixed In: 3.4.13, 3.6.
http://archives.neohapsis.com/archives/bugtraq/2011-12/0184.htmlhttp://www.bugzilla.org/security/3.4.12/https://bugzilla.mozilla.org/show_bug.cgi?id=711714https://exchange.xforce.ibmcloud.com/vulnerabilities/72042http://archives.neohapsis.com/archives/bugtraq/2011-12/0184.htmlhttp://www.bugzilla.org/security/3.4.12/https://bugzilla.mozilla.org/show_bug.cgi?id=711714https://exchange.xforce.ibmcloud.com/vulnerabilities/72042
2012-01-02
Published