PT-2001-1202 · Twig · Twig

Publicado 2001-01-09 · Atualizado 2017-10-10 · CVE-2000-1166

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Twig webmail system (affected versions not specified)

Description The issue concerns the Twig webmail system, which fails to properly set the vhosts variable when it is not configured. This allows remote attackers to insert arbitrary PHP code by specifying an alternate vhosts as an argument to the index.php3 program.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2000-1166

Produtos afetados

Twig

Referências · 5

• http://twig.screwdriver.net/file.php3?file=CHANGELOG · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5581 · Nota
• http://archives.neohapsis.com/archives/bugtraq/2000-11/0351.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2000-1166 · Nota de Segurança
• http://securityfocus.com/bid/1998 · Aviso do Fabricante