CVE-2016-7903

LOW 3.7CVE-2016-7903 · Published 04/01/2017 · updated 17/06/2026

In short

CVE-2016-7903 is a LOW (CVSS 3.7) vulnerability affecting dotclear (dotclear).
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 66.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
dotclear dotclear	`≤ 2.10.2`	No fix yet

Description

Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password reset address link via the HTTP Host header.

References

openwall.com/lists/oss-security/2016/10/05/5 · Mailing List
securityfocus.com/bid/93439
dotclear.org/blog/post/2016/11/01/Dotclear-2.10.3 · Patch
hg.dotclear.org/dotclear/rev/bb06343f4247 · Patch

More vulnerabilities in dotclear

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

dotclear

≤ 2.10.2

No fix yet

More vulnerabilities in dotclear

See all →