CVE-2008-2105 Business logic in n/a

Low 3.5 Published 7 May 2008 Updated 7 Aug 2024

Authenticated users can spoof bug changers via email commands, bypassing audit trails in environments with email verification.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2008-2105?

CVE-2008-2105 is a low-severity vulnerability in Mozilla Bugzilla, published on 7 May 2008. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

email_in.pl in Bugzilla 2.23.4, 3.0.x before 3.0.4, and 3.1.x before 3.1.4 allows remote authenticated users to more easily spoof the changer of a bug via a @reporter command in the body of an e-mail message, which overrides the e-mail address as normally obtained from the From e-mail header. NOTE: since From headers are easily spoofed, this only crosses privilege boundaries in environments that provide additional verification of e-mail addresses.

Weakness: CWE-264

Which versions are affected by CVE-2008-2105?

It affects 1 product.

Products include Mozilla Bugzilla.

How do I fix CVE-2008-2105?

No fix has been published for CVE-2008-2105 yet. Limit exposure of the affected software until one is available.

Is CVE-2008-2105 being exploited?

There is no known exploitation of CVE-2008-2105 in the wild and no public exploit code.

All Mozilla Bugzilla vulnerabilities

Sources

Also known as GHSA-mv65-448j-c255.