CVE-2014-1613

Published: May 16, 2014Modified: May 6, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dc_passwd cookie to a password-protected page, which is not properly handled by (1) inc/public/lib.urlhandlers.php or (2) plugins/pages/_public.php.

Affected (35)

Products: Dotclear: Dotclear

Dotclear

1 product

Dotclear

Configuration A

35 vulnerable

Vulnerable Software	Affected Versions
Dotclear Dotclear	Up to 2.6.1
Dotclear Dotclear	Version 2.0.1
Dotclear Dotclear	Version 2.0.2
Dotclear Dotclear	Version 2.0
Dotclear Dotclear	Version 2.0 beta_2
Dotclear Dotclear	Version 2.0 beta_3
Dotclear Dotclear	Version 2.0 beta_4
Dotclear Dotclear	Version 2.0 beta_5.2
Dotclear Dotclear	Version 2.0 beta_5.4
Dotclear Dotclear	Version 2.0 beta_6
Dotclear Dotclear	Version 2.0 beta_7
Dotclear Dotclear	Version 2.0 rc1
Dotclear Dotclear	Version 2.0 rc2
Dotclear Dotclear	Version 2.1.1
Dotclear Dotclear	Version 2.1.3
Dotclear Dotclear	Version 2.1.4
Dotclear Dotclear	Version 2.1.5
Dotclear Dotclear	Version 2.1.6
Dotclear Dotclear	Version 2.1.7
Dotclear Dotclear	Version 2.1
Dotclear Dotclear	Version 2.2.1
Dotclear Dotclear	Version 2.2.2
Dotclear Dotclear	Version 2.2.3
Dotclear Dotclear	Version 2.2
Dotclear Dotclear	Version 2.3.0
Dotclear Dotclear	Version 2.3.1
Dotclear Dotclear	Version 2.4.2
Dotclear Dotclear	Version 2.4.3
Dotclear Dotclear	Version 2.4.4
Dotclear Dotclear	Version 2.5.0
Dotclear Dotclear	Version 2.5.1
Dotclear Dotclear	Version 2.5.2
Dotclear Dotclear	Version 2.5.3
Dotclear Dotclear	Version 2.6
Dotclear Dotclear	Version 2.6 rc