CVE-2014-1572
Summary
| CVE | CVE-2014-1572 |
|---|---|
| State | PUBLISHED |
| Assigner | mozilla |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2014-10-13 01:55:06 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | The confirm_create_account function in the account-creation feature in token.cgi in Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not specify a scalar context for the realname parameter, which allows remote attackers to create accounts with unverified e-mail addresses by sending three realname values with realname=login_name as the second, as demonstrated by selecting an e-mail address with a domain name for which group privileges are automatically granted. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
NoneIntegrity
PartialAvailability
NoneAV:N/AC:L/Au:N/C:N/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Fedoraproject | Fedora | 19 | All | All | All |
| Operating System | Fedoraproject | Fedora | 20 | All | All | All |
| Operating System | Fedoraproject | Fedora | 21 | All | All | All |
| Application | Mozilla | Bugzilla | 2.0 | All | All | All |
| Application | Mozilla | Bugzilla | 2.10 | All | All | All |
| Application | Mozilla | Bugzilla | 2.12 | All | All | All |
| Application | Mozilla | Bugzilla | 2.14 | All | All | All |
| Application | Mozilla | Bugzilla | 2.14.1 | All | All | All |
| Application | Mozilla | Bugzilla | 2.14.2 | All | All | All |
| Application | Mozilla | Bugzilla | 2.14.3 | All | All | All |
| Application | Mozilla | Bugzilla | 2.14.4 | All | All | All |
| Application | Mozilla | Bugzilla | 2.14.5 | All | All | All |
| Application | Mozilla | Bugzilla | 2.16 | All | All | All |
| Application | Mozilla | Bugzilla | 2.16 | rc1 | All | All |
| Application | Mozilla | Bugzilla | 2.16 | rc2 | All | All |
| Application | Mozilla | Bugzilla | 2.16.1 | All | All | All |
| Application | Mozilla | Bugzilla | 2.16.10 | All | All | All |
| Application | Mozilla | Bugzilla | 2.16.11 | All | All | All |
| Application | Mozilla | Bugzilla | 2.16.2 | All | All | All |
| Application | Mozilla | Bugzilla | 2.16.3 | All | All | All |
| Application | Mozilla | Bugzilla | 2.16.4 | All | All | All |
| Application | Mozilla | Bugzilla | 2.16.5 | All | All | All |
| Application | Mozilla | Bugzilla | 2.16.6 | All | All | All |
| Application | Mozilla | Bugzilla | 2.16.7 | All | All | All |
| Application | Mozilla | Bugzilla | 2.16.8 | All | All | All |
| Application | Mozilla | Bugzilla | 2.16.9 | All | All | All |
| Application | Mozilla | Bugzilla | 2.16_rc2 | All | All | All |
| Application | Mozilla | Bugzilla | 2.17 | All | All | All |
| Application | Mozilla | Bugzilla | 2.17.1 | All | All | All |
| Application | Mozilla | Bugzilla | 2.17.2 | All | All | All |
| Application | Mozilla | Bugzilla | 2.17.3 | All | All | All |
| Application | Mozilla | Bugzilla | 2.17.4 | All | All | All |
| Application | Mozilla | Bugzilla | 2.17.5 | All | All | All |
| Application | Mozilla | Bugzilla | 2.17.6 | All | All | All |
| Application | Mozilla | Bugzilla | 2.17.7 | All | All | All |
| Application | Mozilla | Bugzilla | 2.18 | All | All | All |
| Application | Mozilla | Bugzilla | 2.18 | rc1 | All | All |
| Application | Mozilla | Bugzilla | 2.18 | rc2 | All | All |
| Application | Mozilla | Bugzilla | 2.18 | rc3 | All | All |
| Application | Mozilla | Bugzilla | 2.18.1 | All | All | All |
| Application | Mozilla | Bugzilla | 2.18.2 | All | All | All |
| Application | Mozilla | Bugzilla | 2.18.3 | All | All | All |
| Application | Mozilla | Bugzilla | 2.18.4 | All | All | All |
| Application | Mozilla | Bugzilla | 2.18.5 | All | All | All |
| Application | Mozilla | Bugzilla | 2.18.6 | All | All | All |
| Application | Mozilla | Bugzilla | 2.18.6\+ | All | All | All |
| Application | Mozilla | Bugzilla | 2.18.7 | All | All | All |
| Application | Mozilla | Bugzilla | 2.18.8 | All | All | All |
| Application | Mozilla | Bugzilla | 2.18.9 | All | All | All |
| Application | Mozilla | Bugzilla | 2.19 | All | All | All |
| Application | Mozilla | Bugzilla | 2.19.1 | All | All | All |
| Application | Mozilla | Bugzilla | 2.19.2 | All | All | All |
| Application | Mozilla | Bugzilla | 2.19.3 | All | All | All |
| Application | Mozilla | Bugzilla | 2.2 | All | All | All |
| Application | Mozilla | Bugzilla | 2.20 | All | All | All |
| Application | Mozilla | Bugzilla | 2.20 | rc1 | All | All |
| Application | Mozilla | Bugzilla | 2.20 | rc2 | All | All |
| Application | Mozilla | Bugzilla | 2.20.1 | All | All | All |
| Application | Mozilla | Bugzilla | 2.20.2 | All | All | All |
| Application | Mozilla | Bugzilla | 2.20.3 | All | All | All |
| Application | Mozilla | Bugzilla | 2.20.4 | All | All | All |
| Application | Mozilla | Bugzilla | 2.20.5 | All | All | All |
| Application | Mozilla | Bugzilla | 2.20.6 | All | All | All |
| Application | Mozilla | Bugzilla | 2.20.7 | All | All | All |
| Application | Mozilla | Bugzilla | 2.21 | All | All | All |
| Application | Mozilla | Bugzilla | 2.21.1 | All | All | All |
| Application | Mozilla | Bugzilla | 2.21.2 | All | All | All |
| Application | Mozilla | Bugzilla | 2.21.2 | rc1 | All | All |
| Application | Mozilla | Bugzilla | 2.22 | All | All | All |
| Application | Mozilla | Bugzilla | 2.22 | rc1 | All | All |
| Application | Mozilla | Bugzilla | 2.22.1 | All | All | All |
| Application | Mozilla | Bugzilla | 2.22.2 | All | All | All |
| Application | Mozilla | Bugzilla | 2.22.3 | All | All | All |
| Application | Mozilla | Bugzilla | 2.22.4 | All | All | All |
| Application | Mozilla | Bugzilla | 2.22.5 | All | All | All |
| Application | Mozilla | Bugzilla | 2.22.6 | All | All | All |
| Application | Mozilla | Bugzilla | 2.22.7 | All | All | All |
| Application | Mozilla | Bugzilla | 2.23 | All | All | All |
| Application | Mozilla | Bugzilla | 2.23.1 | All | All | All |
| Application | Mozilla | Bugzilla | 2.23.2 | All | All | All |
| Application | Mozilla | Bugzilla | 2.23.3 | All | All | All |
| Application | Mozilla | Bugzilla | 2.23.4 | All | All | All |
| Application | Mozilla | Bugzilla | 2.4 | All | All | All |
| Application | Mozilla | Bugzilla | 2.6 | All | All | All |
| Application | Mozilla | Bugzilla | 2.8 | All | All | All |
| Application | Mozilla | Bugzilla | 2.9 | All | All | All |
| Application | Mozilla | Bugzilla | 3.0 | All | All | All |
| Application | Mozilla | Bugzilla | 3.0 | rc1 | All | All |
| Application | Mozilla | Bugzilla | 3.0.0 | All | All | All |
| Application | Mozilla | Bugzilla | 3.0.1 | All | All | All |
| Application | Mozilla | Bugzilla | 3.0.10 | All | All | All |
| Application | Mozilla | Bugzilla | 3.0.11 | All | All | All |
| Application | Mozilla | Bugzilla | 3.0.2 | All | All | All |
| Application | Mozilla | Bugzilla | 3.0.3 | All | All | All |
| Application | Mozilla | Bugzilla | 3.0.4 | All | All | All |
| Application | Mozilla | Bugzilla | 3.0.5 | All | All | All |
| Application | Mozilla | Bugzilla | 3.0.6 | All | All | All |
| Application | Mozilla | Bugzilla | 3.0.7 | All | All | All |
| Application | Mozilla | Bugzilla | 3.0.8 | All | All | All |
| Application | Mozilla | Bugzilla | 3.0.9 | All | All | All |
| Application | Mozilla | Bugzilla | 3.0_rc1 | All | All | All |
| Application | Mozilla | Bugzilla | 3.1.0 | All | All | All |
| Application | Mozilla | Bugzilla | 3.1.1 | All | All | All |
| Application | Mozilla | Bugzilla | 3.1.2 | All | All | All |
| Application | Mozilla | Bugzilla | 3.1.3 | All | All | All |
| Application | Mozilla | Bugzilla | 3.1.4 | All | All | All |
| Application | Mozilla | Bugzilla | 3.2 | All | All | All |
| Application | Mozilla | Bugzilla | 3.2 | rc1 | All | All |
| Application | Mozilla | Bugzilla | 3.2 | rc2 | All | All |
| Application | Mozilla | Bugzilla | 3.2.1 | All | All | All |
| Application | Mozilla | Bugzilla | 3.2.10 | All | All | All |
| Application | Mozilla | Bugzilla | 3.2.2 | All | All | All |
| Application | Mozilla | Bugzilla | 3.2.3 | All | All | All |
| Application | Mozilla | Bugzilla | 3.2.4 | All | All | All |
| Application | Mozilla | Bugzilla | 3.2.5 | All | All | All |
| Application | Mozilla | Bugzilla | 3.2.6 | All | All | All |
| Application | Mozilla | Bugzilla | 3.2.7 | All | All | All |
| Application | Mozilla | Bugzilla | 3.2.8 | All | All | All |
| Application | Mozilla | Bugzilla | 3.2.9 | All | All | All |
| Application | Mozilla | Bugzilla | 3.3 | All | All | All |
| Application | Mozilla | Bugzilla | 3.3.1 | All | All | All |
| Application | Mozilla | Bugzilla | 3.3.2 | All | All | All |
| Application | Mozilla | Bugzilla | 3.3.3 | All | All | All |
| Application | Mozilla | Bugzilla | 3.3.4 | All | All | All |
| Application | Mozilla | Bugzilla | 3.4 | All | All | All |
| Application | Mozilla | Bugzilla | 3.4 | rc1 | All | All |
| Application | Mozilla | Bugzilla | 3.4.1 | All | All | All |
| Application | Mozilla | Bugzilla | 3.4.10 | All | All | All |
| Application | Mozilla | Bugzilla | 3.4.11 | All | All | All |
| Application | Mozilla | Bugzilla | 3.4.12 | All | All | All |
| Application | Mozilla | Bugzilla | 3.4.13 | All | All | All |
| Application | Mozilla | Bugzilla | 3.4.2 | All | All | All |
| Application | Mozilla | Bugzilla | 3.4.3 | All | All | All |
| Application | Mozilla | Bugzilla | 3.4.4 | All | All | All |
| Application | Mozilla | Bugzilla | 3.4.5 | All | All | All |
| Application | Mozilla | Bugzilla | 3.4.6 | All | All | All |
| Application | Mozilla | Bugzilla | 3.4.7 | All | All | All |
| Application | Mozilla | Bugzilla | 3.4.8 | All | All | All |
| Application | Mozilla | Bugzilla | 3.4.9 | All | All | All |
| Application | Mozilla | Bugzilla | 3.5 | All | All | All |
| Application | Mozilla | Bugzilla | 3.5.1 | All | All | All |
| Application | Mozilla | Bugzilla | 3.5.2 | All | All | All |
| Application | Mozilla | Bugzilla | 3.5.3 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6 | rc1 | All | All |
| Application | Mozilla | Bugzilla | 3.6.0 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6.1 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6.10 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6.11 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6.12 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6.13 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6.2 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6.3 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6.4 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6.5 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6.6 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6.7 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6.8 | All | All | All |
| Application | Mozilla | Bugzilla | 3.6.9 | All | All | All |
| Application | Mozilla | Bugzilla | 3.7 | All | All | All |
| Application | Mozilla | Bugzilla | 3.7.1 | All | All | All |
| Application | Mozilla | Bugzilla | 3.7.2 | All | All | All |
| Application | Mozilla | Bugzilla | 3.7.3 | All | All | All |
| Application | Mozilla | Bugzilla | 4.0 | All | All | All |
| Application | Mozilla | Bugzilla | 4.0 | rc1 | All | All |
| Application | Mozilla | Bugzilla | 4.0 | rc2 | All | All |
| Application | Mozilla | Bugzilla | 4.0.1 | All | All | All |
| Application | Mozilla | Bugzilla | 4.0.10 | All | All | All |
| Application | Mozilla | Bugzilla | 4.0.11 | All | All | All |
| Application | Mozilla | Bugzilla | 4.0.12 | All | All | All |
| Application | Mozilla | Bugzilla | 4.0.13 | All | All | All |
| Application | Mozilla | Bugzilla | 4.0.14 | All | All | All |
| Application | Mozilla | Bugzilla | 4.1 | All | All | All |
| Application | Mozilla | Bugzilla | 4.1.1 | All | All | All |
| Application | Mozilla | Bugzilla | 4.1.2 | All | All | All |
| Application | Mozilla | Bugzilla | 4.1.3 | All | All | All |
| Application | Mozilla | Bugzilla | 4.2 | All | All | All |
| Application | Mozilla | Bugzilla | 4.2 | rc1 | All | All |
| Application | Mozilla | Bugzilla | 4.2 | rc2 | All | All |
| Application | Mozilla | Bugzilla | 4.2.1 | All | All | All |
| Application | Mozilla | Bugzilla | 4.2.10 | All | All | All |
| Application | Mozilla | Bugzilla | 4.2.2 | All | All | All |
| Application | Mozilla | Bugzilla | 4.2.3 | All | All | All |
| Application | Mozilla | Bugzilla | 4.2.4 | All | All | All |
| Application | Mozilla | Bugzilla | 4.2.5 | All | All | All |
| Application | Mozilla | Bugzilla | 4.2.6 | All | All | All |
| Application | Mozilla | Bugzilla | 4.2.7 | All | All | All |
| Application | Mozilla | Bugzilla | 4.2.8 | All | All | All |
| Application | Mozilla | Bugzilla | 4.2.9 | All | All | All |
| Application | Mozilla | Bugzilla | 4.3 | All | All | All |
| Application | Mozilla | Bugzilla | 4.3.1 | All | All | All |
| Application | Mozilla | Bugzilla | 4.3.2 | All | All | All |
| Application | Mozilla | Bugzilla | 4.3.3 | All | All | All |
| Application | Mozilla | Bugzilla | 4.4 | All | All | All |
| Application | Mozilla | Bugzilla | 4.4 | rc1 | All | All |
| Application | Mozilla | Bugzilla | 4.4 | rc2 | All | All |
| Application | Mozilla | Bugzilla | 4.4.1 | All | All | All |
| Application | Mozilla | Bugzilla | 4.4.2 | All | All | All |
| Application | Mozilla | Bugzilla | 4.4.3 | All | All | All |
| Application | Mozilla | Bugzilla | 4.4.4 | All | All | All |
| Application | Mozilla | Bugzilla | 4.4.5 | All | All | All |
| Application | Mozilla | Bugzilla | 4.5 | All | All | All |
| Application | Mozilla | Bugzilla | 4.5.1 | All | All | All |
| Application | Mozilla | Bugzilla | 4.5.2 | All | All | All |
| Application | Mozilla | Bugzilla | 4.5.3 | All | All | All |
| Application | Mozilla | Bugzilla | 4.5.4 | All | All | All |
| Application | Mozilla | Bugzilla | 4.5.5 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| 4.0.14, 4.2.10, 4.4.5, and 4.5.5 Security Advisory :: Bugzilla :: bugzilla.org | af854a3a-2127-422b-91ae-364da2661108 | www.bugzilla.org | Vendor Advisory |
| [SECURITY] Fedora 20 Update: bugzilla-4.2.11-1.fc20 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| Bugzilla Account Creation / XSS / Information Leak ≈ Packet Storm | af854a3a-2127-422b-91ae-364da2661108 | packetstormsecurity.com | |
| [SECURITY] Fedora 19 Update: bugzilla-4.2.11-1.fc19 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| 1074812 – (CVE-2014-1572) [SECURITY] The 'realname' parameter is not correctly filtered on user account creation, leading to user data override | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.mozilla.org | Patch |
| Mageia Advisory: MGASA-2014-0412 - Updated bugzilla packages fix security vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | advisories.mageia.org | |
| [SECURITY] Fedora 21 Update: bugzilla-4.4.6-1.fc21 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| New Class of Vulnerability in Perl Web Applications : netsec | af854a3a-2127-422b-91ae-364da2661108 | www.reddit.com | |
| www.opennet.ru/opennews/art.shtml | af854a3a-2127-422b-91ae-364da2661108 | www.opennet.ru | |
| Support / Security / Advisories / / MDVSA-2014:200 | Mandriva | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| oss-security - "New Class of Vulnerability in Perl Web Applications" | af854a3a-2127-422b-91ae-364da2661108 | openwall.com | |
| New Class of Vulnerability in Perl Web Applications | Hacking for Christ | af854a3a-2127-422b-91ae-364da2661108 | blog.gerv.net | |
| Bugzilla Bugs Let Remote Users Create Unauthorized, Conduct Cross-Site Scripting Attacks, and Obtain Potentially Sensitive Information - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | |
| Bugzilla: Multiple vulnerabilities (GLSA 201607-11) — Gentoo security | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.