Description

Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password reset address link via the HTTP Host header.

Remediation

References

CVE-2016-7903

Related Vulnerabilities

WordPress Plugin Easy Google Analytics for WordPress Cross-Site Request Forgery (1.6.0)

WordPress Plugin Mapplic-Custom Interactive Map Server-Side Request Forgery (6.1)

WordPress Plugin WP Inventory Manager Unspecified Vulnerability (1.8.1)

Piwigo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2021-40313)

Apache HTTP Server NULL Pointer Dereference Vulnerability (CVE-2009-3094)

Severity

Low

Classification

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-264 CVE-2016-7903