CVE-2014-3781

EUVD-2014-3720
The dcXmlRpc::setUser method in nc/core/class.dc.xmlrpc.php in Dotclear before 2.6.3 allows remote attackers to bypass authentication via an empty password in an XML-RPC request.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 63%
Affected Products (NVD)
VendorProductVersion
dotcleardotclear
𝑥
≤ 2.6.2
dotcleardotclear
2.6
dotcleardotclear
2.6:rc
dotcleardotclear
2.6.1
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
dotclear
artful
dne
bionic
dne
cosmic
dne
disco
dne
lucid
dne
precise
ignored
saucy
ignored
trusty
dne
utopic
ignored
vivid
ignored
wily
ignored
xenial
not-affected
yakkety
dne
zesty
dne
Common Weakness Enumeration
References
http://dotclear.org/blog/post/2014/05/16/Dotclear-2.6.3
http://karmainsecurity.com/KIS-2014-05
http://packetstormsecurity.com/files/126766/Dotclear-2.6.2-Authentication-Bypass.html
http://seclists.org/fulldisclosure/2014/May/107
http://secunia.com/advisories/58675
http://dotclear.org/blog/post/2014/05/16/Dotclear-2.6.3
http://karmainsecurity.com/KIS-2014-05
http://packetstormsecurity.com/files/126766/Dotclear-2.6.2-Authentication-Bypass.html
http://seclists.org/fulldisclosure/2014/May/107
http://secunia.com/advisories/58675