PT-2016-6150 · Dotcms · Dotcms

Elar Lang · Published 2016-06-30 · Updated 2016-11-28 · CVE-2016-4803

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions dotCMS versions prior to 3.3.2

Description The issue concerns a CRLF injection vulnerability in the send email functionality. This allows remote attackers to inject arbitrary email headers via CRLF sequences in the subject.

Recommendations For versions prior to 3.3.2, update to version 3.3.2 or later to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2016-4803

Affected Products

Dotcms

References · 7

• 🔥 http://seclists.org/fulldisclosure/2016/May/69 · Exploit
• 🔥 https://security.elarlang.eu/cve-2016-4803-dotcms-email-header-injection-vulnerability-full-disclosure.html · Exploit
• https://osv.dev/vulnerability/CVE-2016-4803 · Vendor Advisory
• https://dotcms.com/docs/latest/change-log#release-3.3.2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4803 · Security Note
• http://securityfocus.com/bid/91529 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4803 · Note