PT-2016-7517 · Dotcms · Dotcms

Elar Lang · Published 2016-10-28 · Updated 2016-11-28 · CVE-2016-8600

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions dotCMS version 3.2.1

Description The issue allows an attacker to bypass the captcha check by loading the captcha once, filling it with the correct value, and then reusing this correct value for subsequent forms that have a captcha check.

Recommendations For dotCMS version 3.2.1, consider implementing a unique captcha for each form submission to prevent reuse of previously entered correct values. As a temporary workaround, restrict the ability to submit forms with a captcha check to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-254

CWE-264

Related Identifiers

CVE-2016-8600

Affected Products

Dotcms

References · 7

• 🔥 http://seclists.org/fulldisclosure/2016/Oct/63 · Exploit
• 🔥 https://security.elarlang.eu/cve-2016-8600-dotcms-captcha-bypass-by-reusing-valid-code.html · Exploit
• https://github.com/dotCMS/core/issues/9330 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-8600 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8600 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8600 · Note
• http://securityfocus.com/bid/93798 · Note