CVE-2008-2104: Mozilla Bugzilla

Medium severity, CVSS 4.0. EPSS: 0.9% chance of exploitation in the next 30 days.

The WebService in Bugzilla 3.1.3 allows remote authenticated users without canconfirm privileges to create NEW or ASSIGNED bug entries via a request to the XML-RPC interface, which bypasses the canconfirm check.

Affected products

• Mozilla Bugzilla: version 3.1.3 only

Published 2008-05-07. Last modified 2026-06-16.