Util.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.15, 4.3.x and 4.4.x before 4.4.10, and 5.x before 5.0.1 mishandles long e-mail addresses during account registration, which allows remote attackers to obtain the default privileges for an arbitrary domain name by placing that name in a substring of an address, as demonstrated by truncation of an @mozilla.com.example.com address to an @mozilla.com address.
Advisories
| Source | ID | Title |
|---|---|---|
EUVD |
EUVD-2015-4519 | Util.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.15, 4.3.x and 4.4.x before 4.4.10, and 5.x before 5.0.1 mishandles long e-mail addresses during account registration, which allows remote attackers to obtain the default privileges for an arbitrary domain name by placing that name in a substring of an address, as demonstrated by truncation of an @mozilla.com.example.com address to an @mozilla.com address. |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
No history.
Projects
Sign in to view the affected projects.
Status: PUBLISHED
Assigner: mozilla
Published:
Updated: 2024-08-06T06:18:11.279Z
Reserved: 2015-06-10T00:00:00.000Z
Link: CVE-2015-4499
No data.
Status : Deferred
Published: 2015-09-14T01:59:01.607
Modified: 2025-04-12T10:46:40.837
Link: CVE-2015-4499
No data.
OpenCVE Enrichment
No data.
Weaknesses
EUVD