CVE-2016-7903 | BDVDB-2026-80031 Detail

Description#

Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password reset address link via the HTTP Host header.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://dotclear.org/blog/post/2016/11/01/Dotclear-2.10.3
https://hg.dotclear.org/dotclear/rev/bb06343f4247
http://www.securityfocus.com/bid/93439
http://www.openwall.com/lists/oss-security/2016/10/05/5

Exploit#

No public exploit known

History#

Version 12017-01-04Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.