In dotCMS 3.2.1, attacker can load captcha once, fill it with correct value and then this…
Priority LOW 36CWE-254Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-264.
Summary
In dotCMS 3.2.1, attacker can load captcha once, fill it with correct value and then this correct value is ok for forms with captcha check later.
Why it matters now
EPSS 0.0175 77th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2016-8600
- 2026-10-03 Alias added: GHSA-3cq5-qfhj-hhcc
References
More Dotcms vulnerabilities
- TI-2022-09726 An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. KEVCVSS 3.1CRITICAL 9.8
- TI-2020-05479 dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access… CVSS 3.1CRITICAL 9.8
- TI-2020-13533 Unrestricted Upload of File with Dangerous Type in DotCMS v5.2.3 and earlier allow remote… CVSS 3.1CRITICAL 9.8
- TI-2017-03385 An issue was discovered in dotCMS through 3.6.1. CVSS 3.0CRITICAL 9.8
- TI-2016-07300 SQL injection vulnerability in the categoriesServlet servlet in dotCMS before 3.3.1… CVSS 3.0CRITICAL 9.8
- TI-2016-02117 SQL injection vulnerability in the REST API in dotCMS before 3.3.2 allows remote… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2016-8600 · CVE Program
- CVE-2016-8600 · NVD
- FIRST EPSS
- GHSA-3cq5-qfhj-hhcc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences