high7.5
CVE-2016-8600
In dotCMS 3.2.1, attacker can load captcha once, fill it with correct value and then this correct value is ok for forms with captcha check later.
Impact
In dotCMS 3.2.1, attacker can load captcha once, fill it with correct value and then this correct value is ok for forms with captcha check later.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dotcms | Dotcms | Version 3.2.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://seclists.org/fulldisclosure/2016/Oct/63
- http://www.securityfocus.com/bid/93798
- https://github.com/dotCMS/core/issues/9330
- https://security.elarlang.eu/cve-2016-8600-dotcms-captcha-bypass-by-reusing-valid-code.html
- http://seclists.org/fulldisclosure/2016/Oct/63
- http://www.securityfocus.com/bid/93798
- https://github.com/dotCMS/core/issues/9330
- https://security.elarlang.eu/cve-2016-8600-dotcms-captcha-bypass-by-reusing-valid-code.html