CVE-2014-3781

Dotclear < 2.6.3 - Unauthenticated Authentication Bypass via XML-RPC Empty Password

Title source: llm
STIX 2.1

Description

The dcXmlRpc::setUser method in nc/core/class.dc.xmlrpc.php in Dotclear before 2.6.3 allows remote attackers to bypass authentication via an empty password in an XML-RPC request.

References (5)

Core 5
Core References
Vendor Advisory x_refsource_confirm
http://dotclear.org/blog/post/2014/05/16/Dotclear-2.6.3
Exploit mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/May/107
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/58675
Exploit x_refsource_misc
http://karmainsecurity.com/KIS-2014-05

Scores

EPSS 0.0218
EPSS Percentile 80.1%

Details

CWE
CWE-287
Status published
Products (3)
dotclear/dotclear 2.6 (2 CPE variants)
dotclear/dotclear 2.6.1
dotclear/dotclear < 2.6.2
Published Jun 11, 2014
Tracked Since Feb 18, 2026