CVE-2016-7903

Description

Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password reset address link via the HTTP Host header.

References

https://hg.dotclear.org/dotclear/rev/bb06343f4247

https://dotclear.org/blog/post/2016/11/01/Dotclear-2.10.3

http://www.securityfocus.com/bid/93439

http://www.openwall.com/lists/oss-security/2016/10/05/5

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS