CVE-2014-1613

Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dc_passwd cookie to a password-protected page, which…

published May 16, 2014

CVSS
—
EPSS
2%
Percentile
82.9
In the wild
Unconfirmed
What it is

Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dc_passwd cookie to a password-protected page, which is not properly handled by (1) inc/public/lib.urlhandlers.php or (2) plugins/pages/_public.php.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02285 · 82.9th percentile
Published
2014-05-16T15:00Z
EPSS history
Timeline
  • 16 MAY 15:00Z
    Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dc_passwd cookie to a password-protected page, which…
    cvelistv5