PT-2005-3740 · Twiki · Twiki

Sap · Publicado 2005-09-16 · Atualizado 2016-10-18 · CVE-2005-2877

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TWiki versions prior to 02-Sep-2004

Description The issue allows remote attackers to execute arbitrary code via shell metacharacters. This can be demonstrated via the rev parameter to the TWikiUsers function.

Recommendations For TWiki versions prior to 02-Sep-2004, update to a version released after 02-Sep-2004 to resolve the issue. As a temporary workaround, consider restricting access to the TWikiUsers function to minimize the risk of exploitation. Avoid using the rev parameter in the affected function until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2005-2877

Produtos afetados

Twiki

Referências · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/twiki_history.rb · Exploit
• 🔥 https://exploit-db.com/exploits/26260 · Exploit
• 🔥 http://securityfocus.com/bid/14834 · Exploit
• 🔥 https://exploit-db.com/exploits/16892 · Exploit
• 🔥 https://exploit-db.com/exploits/26302 · Exploit
• http://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithRev · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2877 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-2877 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=112680475417550&w=2 · Nota
• http://kb.cert.org/vuls/id/757181 · Correção