CVE-2011-2978

CVE-2011-2978 describes a vulnerability in multiple versions of Bugzilla (2.16rc1 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3) where the system fails to prevent unauthorized changes to the confirmation email address for email change notifications. This flaw allows remote attackers to easily perform arbitrary address changes, particularly from an unattended workstation. The vulnerability has a CVSS score of 5.0 (Medium), indicating a network-based attack with low complexity, requiring no authentication, and resulting in a partial impact to integrity. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.