Detections
Analytics
CVE-2007-5038
high
Description
The offer_account_by_email function in User.pm in the WebService for Bugzilla before 3.0.2, and 3.1.x before 3.1.2, does not check the value of the createemailregexp parameter, which allows remote attackers to bypass intended restrictions on account creation.
References
https://exchange.xforce.ibmcloud.com/vulnerabilities/36692
https://bugzilla.redhat.com/show_bug.cgi?id=299981
http://www.vupen.com/english/advisories/2007/3200
http://www.securitytracker.com/id?1018719
http://www.securityfocus.com/bid/25725
http://www.securityfocus.com/archive/1/480077/100/0/threaded
http://www.bugzilla.org/security/3.0.1/
http://secunia.com/advisories/26969