CVE-2016-7903

3.7 LOW

Published: January 04, 2017 Modified: May 06, 2026

Description

Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password reset address link via the HTTP Host header.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

http://www.openwall.com/lists/oss-security/2016/10/05/5

Source: cve@mitre.org

Mailing List

http://www.securityfocus.com/bid/93439

Source: cve@mitre.org

https://dotclear.org/blog/post/2016/11/01/Dotclear-2.10.3

Source: cve@mitre.org

Patch Vendor Advisory

https://hg.dotclear.org/dotclear/rev/bb06343f4247

Source: cve@mitre.org

Patch

http://www.openwall.com/lists/oss-security/2016/10/05/5

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

http://www.securityfocus.com/bid/93439

Source: af854a3a-2127-422b-91ae-364da2661108

https://dotclear.org/blog/post/2016/11/01/Dotclear-2.10.3

Source: af854a3a-2127-422b-91ae-364da2661108

Patch Vendor Advisory

https://hg.dotclear.org/dotclear/rev/bb06343f4247

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

8 reference(s) from NVD

Quick Stats

CVSS v3 Score

3.7 / 10.0

EPSS (Exploit Probability)

0.3%

51th percentile

Exploitation Status

Not in CISA KEV

Weaknesses (CWE)

CWE-264

Affected Vendors

dotclear

Related CVEs