The dcXmlRpc::setUser method in nc/core/class.dc.xmlrpc.php in Dotclear prior to 2.6.3 allows remote malicious users to bypass authentication via an empty password in an XML-RPC request.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
dotclear dotclear |
||
dotclear dotclear 2.6.1 |
||
dotclear dotclear 2.6 |