CVE-2011-2978 Business logic in n/a
Attackers can change email addresses on unattended workstations, potentially leading to account takeover in Bugzilla.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2011-2978?
CVE-2011-2978 is a medium-severity vulnerability in Mozilla Bugzilla, published on 9 Aug 2011. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Bugzilla 2.16rc1 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 does not prevent changes to the confirmation e-mail address (aka old_email field) for e-mail change notifications, which makes it easier for remote attackers to perform arbitrary address changes by leveraging an unattended workstation.
Weakness: CWE-20
Which versions are affected by CVE-2011-2978?
It affects 1 product.
Products include Mozilla Bugzilla.
How do I fix CVE-2011-2978?
Upgrade to a fixed version.
Is CVE-2011-2978 being exploited?
There is no known exploitation of CVE-2011-2978 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Bugzilla
Sources
Also known as GHSA-rrm5-5c6m-75m4.