CVEvulnerability
CVE-2016-7903
3.7 LOW
Official page ↗
- Status
- Modified
- Published
- 2017-01-04
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 3.7 LOW — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-264
Description
Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password reset address link via the HTTP Host header.
Affected configurations
• dotclear dotclear (<= 2.10.2)
Related
Weakness · not in database (1)
References
- http://www.openwall.com/lists/oss-security/2016/10/05/5 Mailing List
- http://www.securityfocus.com/bid/93439 www.securityfocus.com
- https://dotclear.org/blog/post/2016/11/01/Dotclear-2.10.3 Patch, Vendor Advisory
- https://hg.dotclear.org/dotclear/rev/bb06343f4247 Patch
- http://www.openwall.com/lists/oss-security/2016/10/05/5 Mailing List
- http://www.securityfocus.com/bid/93439 www.securityfocus.com
- https://dotclear.org/blog/post/2016/11/01/Dotclear-2.10.3 Patch, Vendor Advisory
- https://hg.dotclear.org/dotclear/rev/bb06343f4247 Patch