CVE-2016-7903
Dotclear before 2.10.3, when the Host header is not part of the web server routing process,...
CVE-2016-7903 is a low vulnerability (CVSS 3.7) in Dotclear, published January 4, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.12%, the 66th percentile. No source names a fixed version.
Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password reset address link via the HTTP Host header.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password reset address link via the HTTP Host header.
- Record
CVE-2016-7903- CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password reset address link via the HTTP Host header.
- Record
CVE-2016-7903- Updated
- 2026-11-02
EUVDEUVD-2016-8752 No score
Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password reset address link via the HTTP Host header.
- Record
EUVD-2016-8752- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m62w-37gh-m9j3
Dotclear before 2.10.3, when the Host header is not part of the web server routing process,...
Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password reset address link via the HTTP Host header.
- Record
GHSA-m62w-37gh-m9j3- CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSV
Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password reset address link via the HTTP Host header.
- Record
CVE-2016-7903- CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-7903
Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password reset address link via the HTTP Host header.
- Record
UBUNTU-CVE-2016-7903- CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dotclearUbuntu:16.04:LTS |
All versions, plus listed versions 2.7.5+dfsg-12.8.0+dfsg-12.8.0+dfsg-1ubuntu1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
dotclear.org/blog/post/2016/11/01/Dotclear-2.10.3
hg.dotclear.org/dotclear/rev/bb06343f4247
securityfocus.com/bid/93439
openwall.com/lists/oss-security/2016/10/05/5
nvd.nist.gov/vuln/detail/CVE-2016-7903
github.com/advisories/GHSA-m62w-37gh-m9j3
ubuntu.com/security/CVE-2016-7903
cve.org/CVERecord?id=CVE-2016-7903