PT-2016-7517 · Dotcms · Dotcms

Elar Lang · Publicado 2016-10-28 · Atualizado 2016-11-28 · CVE-2016-8600

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions dotCMS version 3.2.1

Description The issue allows an attacker to bypass the captcha check by loading the captcha once, filling it with the correct value, and then reusing this correct value for subsequent forms that have a captcha check.

Recommendations For dotCMS version 3.2.1, consider implementing a unique captcha for each form submission to prevent reuse of previously entered correct values. As a temporary workaround, restrict the ability to submit forms with a captcha check to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-254

CWE-264

Identificadores relacionados

CVE-2016-8600

Produtos afetados

Dotcms

Referências · 7

• 🔥 http://seclists.org/fulldisclosure/2016/Oct/63 · Exploit
• 🔥 https://security.elarlang.eu/cve-2016-8600-dotcms-captcha-bypass-by-reusing-valid-code.html · Exploit
• https://github.com/dotCMS/core/issues/9330 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8600 · Nota
• http://securityfocus.com/bid/93798 · Nota
• https://osv.dev/vulnerability/CVE-2016-8600 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-8600 · Nota de Segurança