Vulnerability Details : CVE-2007-5038
The offer_account_by_email function in User.pm in the WebService for Bugzilla before 3.0.2, and 3.1.x before 3.1.2, does not check the value of the createemailregexp parameter, which allows remote attackers to bypass intended restrictions on account creation.
Exploit prediction scoring system (EPSS) score for CVE-2007-5038
Probability of exploitation activity in the next 30 days: 2.11%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 88 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2007-5038
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
CWE ids for CVE-2007-5038
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2007-5038
-
https://bugzilla.mozilla.org/show_bug.cgi?id=395632
Exploit
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/36692
-
http://www.securityfocus.com/archive/1/480077/100/0/threaded
-
https://bugzilla.redhat.com/show_bug.cgi?id=299981
- http://fedoranews.org/updates/FEDORA-2007-229.shtml
-
http://www.bugzilla.org/security/3.0.1/
Patch
-
http://www.securitytracker.com/id?1018719
-
http://www.securityfocus.com/bid/25725
-
http://www.vupen.com/english/advisories/2007/3200
Products affected by CVE-2007-5038
- cpe:2.3:a:mozilla:bugzilla:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:bugzilla:3.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:bugzilla:3.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:bugzilla:3.1.0:*:*:*:*:*:*:*