Unscored CVE-2016-7903 EUVD-2016-8752GHSA-m62w-37gh-m9j3

Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password …

Published Jan 4, 2017 · Updated Aug 6, 2024 · Assigned by mitre

Description

Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password reset address link via the HTTP Host header.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	dotclear	No fix yet	—

References

https://dotclear.org/blog/post/2016/11/01/Dotclear-2.10.3
https://hg.dotclear.org/dotclear/rev/bb06343f4247
93439 vdb-entry
[oss-security] 20161005 CVE-2016-7903: Dotclear <= 2.10.2 Password Reset Address Spoof mailing-list