CVE-2016-7903

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password reset address link via the HTTP Host header.

Metrics

CVSS 3.0 3.7/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2016/10/05/5Mailing List
http://www.securityfocus.com/bid/93439
https://dotclear.org/blog/post/2016/11/01/Dotclear-2.10.3Patch, Vendor Advisory
https://hg.dotclear.org/dotclear/rev/bb06343f4247Patch
http://www.openwall.com/lists/oss-security/2016/10/05/5Mailing List
http://www.securityfocus.com/bid/93439
https://dotclear.org/blog/post/2016/11/01/Dotclear-2.10.3Patch, Vendor Advisory
https://hg.dotclear.org/dotclear/rev/bb06343f4247Patch

Timeline

Published: Jan 4, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-79048.0Cross-site request forgery (CSRF) vulnerability in CMS Made Simple before 2.1.6 allows remote attackers to hijack the authentication of admi CVE-2016-79055.5The read_gab2_sub function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (NULL pointer CVE-2016-79065.5magick/attribute.c in ImageMagick 7.0.3-2 allows remote attackers to cause a denial of service (use-after-free) via a crafted file.CVE-2016-79074.4The imx_fec_do_tx function in hw/net/imx_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmi CVE-2016-79084.4The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmi CVE-2016-79094.4The pcnet_rdra_addr function in hw/net/pcnet.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of servic CVE-2016-79107.8Use-after-free vulnerability in the disk_seqf_stop function in block/genhd.c in the Linux kernel before 4.7.1 allows local users to gain pri CVE-2016-79117.8Race condition in the get_task_ioprio function in block/ioprio.c in the Linux kernel before 4.6.6 allows local users to gain privileges or c CVE-2016-79127.8Use-after-free vulnerability in the ffs_user_copy_worker function in drivers/usb/gadget/function/f_fs.c in the Linux kernel before 4.5.3 all CVE-2016-79137.8The xc2028_set_config function in drivers/media/tuners/tuner-xc2028.c in the Linux kernel before 4.6 allows local users to gain privileges o CVE-2016-79145.5The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.5.3 does not check whether a slot is a CVE-2016-79155.5The hid_input_field function in drivers/hid/hid-core.c in the Linux kernel before 4.6 allows physically proximate attackers to obtain sensit