Description

Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password reset address link via the HTTP Host header.

Remediation

References

CVE-2016-7903

Related Vulnerabilities

Jenkins Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2021-21607)

Skipper Server-Side Request Forgery (SSRF) Vulnerability (CVE-2022-38580)

WordPress Plugin MasterStudy LMS-for Online Courses and Education SQL Injection (3.2.5)

WordPress Plugin Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) Multiple Vulnerabilities (2.3)

Internet Information Services Other Vulnerability (CVE-2006-6579)

Severity

Low

Classification

CVE-2016-7903 CWE-264 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities