Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password reset addre...

参照URL

• patch dotclear.org
• patch hg.dotclear.org
• web securityfocus.com
• web openwall.com