CVE-2015-4499

High

Published: 14/09/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

Util.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.15, 4.3.x and 4.4.x before 4.4.10, and 5.x before 5.0.1 mishandles long e-mail addresses during account registration. This allows remote attackers to obtain the default privileges for an arbitrary domain name by placing that name in a substring of an address.

Risk Assessment

Attackers can exploit this vulnerability to gain unauthorized access to user accounts, potentially leading to data security breaches within the organization.

Recommendation

It is recommended to update Bugzilla to the latest version to eliminate this vulnerability and to review the user account registration policy to enhance security.

Other vulnerabilities in Bugzilla

CVE-2000-0421High
The process_bug.cgi script in Bugzilla allows remote attackers to execute arbitrary commands via shell metacharacters.

Original NVD description (English source)

Util.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.15, 4.3.x and 4.4.x before 4.4.10, and 5.x before 5.0.1 mishandles long e-mail addresses during account registration, which allows remote attackers to obtain the default privileges for an arbitrary domain name by placing that name in a substring of an address, as demonstrated by truncation of an @mozilla.com.example.com address to an @mozilla.com address.