CVE-2014-1572

La función confirm_create_account en la caracteristica account-creation en token.cgi en Bugzilla 2.x hasta 4.0.x anterior a 4.0.15, 4.1.x y 4.2.x anterior a 4.2.11, 4.3.x y 4.4.x anterior a 4.4.6, y 4.5.x anterior a 4.5.6 no especifica un contexto escalar para el parámetro realname, lo que permite a atacantes remotos crear cuentas con direcciones de e-mail no verificadas mediante el envío de tres valores realname con realname=login_name como el segundo, tal y como fue demostrado mediante la selección de una dirección de e-mail con un nombre de dominio para el cual privilegios de grupo se ceden automáticamente.

If a new comment was marked private to the insider group, and a flag was set in the same transaction, the comment would be visible to flag recipients even if they were not in the insider group. An attacker creating a new Bugzilla account can override certain parameters when finalizing the account creation that can lead to the user being created with a different email address than originally requested. The overridden login name could be automatically added to groups based on the group's regular expression setting. During an audit of the Bugzilla code base, several places were found where cross-site scripting exploits could occur which could allow an attacker to access sensitive information.