PT-2016-6150 · Dotcms · Dotcms

Elar Lang · Publicado 2016-06-30 · Atualizado 2016-11-28 · CVE-2016-4803

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions dotCMS versions prior to 3.3.2

Description The issue concerns a CRLF injection vulnerability in the send email functionality. This allows remote attackers to inject arbitrary email headers via CRLF sequences in the subject.

Recommendations For versions prior to 3.3.2, update to version 3.3.2 or later to resolve the issue.

Exploit

Correção

Identificadores relacionados

CVE-2016-4803

Produtos afetados

Dotcms

Referências · 7

• 🔥 http://seclists.org/fulldisclosure/2016/May/69 · Exploit
• 🔥 https://security.elarlang.eu/cve-2016-4803-dotcms-email-header-injection-vulnerability-full-disclosure.html · Exploit
• https://osv.dev/vulnerability/CVE-2016-4803 · Aviso do Fabricante
• http://securityfocus.com/bid/91529 · Nota
• https://dotcms.com/docs/latest/change-log#release-3.3.2 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4803 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-4803 · Nota de Segurança