Description
The WebService in Bugzilla 3.1.3 allows remote authenticated users without canconfirm privileges to create NEW or ASSIGNED bug entries via a request to the XML-RPC interface, which bypasses the canconfirm check.
References
- 29038 vdb-entry
- 1019968 vdb-entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=415471
- 30064 third-party-advisory
- bugzilla-xmlrpc-security-bypass(42218) vdb-entry
- http://www.bugzilla.org/security/2.20.5/
- ADV-2008-1428 vdb-entry