CVE-2014-8630
Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x...
CVE-2014-8630 is a medium vulnerability (CVSS 6.5) in Mozilla Bugzilla, published January 31, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.04%, the 81st percentile. Fixed in bugzilla 4.4.8-1.mga4.
- Severity
- 6.5 MediumCVSS 2.0, NVD
- Exploit chance
- 2.04%EPSS, 81st percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.4.8-1.mga4bugzilla
Description
Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x before 5.0rc1 allows remote authenticated users to execute arbitrary commands by leveraging the editcomponents privilege and triggering crafted input to a two-argument Perl open call, as demonstrated by shell metacharacters in a product name.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bugzillaMageia:4 | before 4.4.8-1.mga4 | 4.4.8-1.mga4 |
What each source reports
NVD Score used
Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x before 5.0rc1 allows remote authenticated users to execute arbitrary commands by leveraging the editcomponents privilege and triggering crafted input to a two-argument Perl open call, as demonstrated by shell metacharacters in a product name.
- Record
CVE-2014-8630- CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-77
- Updated
- 2026-11-02
CVE ListNo score
Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x before 5.0rc1 allows remote authenticated users to execute arbitrary commands by leveraging the editcomponents privilege and triggering crafted input to a two-argument Perl open call, as demonstrated by shell metacharacters in a product name.
- Record
CVE-2014-8630- Updated
- 2026-11-02
EUVDEUVD-2014-8467No score
Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x before 5.0rc1 allows remote authenticated users to execute arbitrary commands by leveraging the editcomponents privilege and triggering crafted input to a two-argument Perl open call, as demonstrated by shell metacharacters in a product name.
- Record
EUVD-2014-8467- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hwjw-h532-j9qqNo score
Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x...
Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x before 5.0rc1 allows remote authenticated users to execute arbitrary commands by leveraging the editcomponents privilege and triggering crafted input to a two-argument Perl open call, as demonstrated by shell metacharacters in a product name.
- Record
GHSA-hwjw-h532-j9qq- Weakness
- CWE-77
- Updated
- 2026-11-02
OSVMGASA-2015-0048No score
Updated bugzilla packages fix CVE-2014-8630
Updated bugzilla packages fix security vulnerability:
Some code in Bugzilla does not properly utilize 3 arguments form for open() and it is possible for an account with editcomponents permissions to inject commands into product names and other attributes (CVE-2014-8630).
- Record
MGASA-2015-0048- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
advisories.mageia.org/MGASA-2015-0048.html
bugzilla.mozilla.org/show_bug.cgi?id=1079065
lists.fedoraproject.org/pipermail/package-announce/2015-February/149921.html
mandriva.com/security/advisories?name=MDVSA-2015:030
security.gentoo.org/glsa/201607-11