PT-2006-2396 · Twiki · Twiki

Kenneth Lavrsen · Publicado 2006-03-26 · Atualizado 2017-07-20 · CVE-2006-1387

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions TWiki versions 20010901 through 20040904 TWiki version 4.0 TWiki version 4.0.1

Description The issue allows remote authenticated users with edit rights to cause a denial of service. This is achieved through INCLUDE by URL statements that form a loop, such as a page that includes itself, leading to infinite recursion and consumption of CPU and memory.

Recommendations For TWiki versions 20010901 through 20040904, consider restricting the use of INCLUDE by URL statements to prevent loops. For TWiki version 4.0, avoid using self-including pages to minimize the risk of exploitation. For TWiki version 4.0.1, restrict access to edit rights to minimize the potential for denial of service attacks.

Correção

Identificadores relacionados

CVE-2006-1387

Produtos afetados

Twiki

Referências · 7

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1387 · Nota
• http://twiki.org/cgi-bin/view/Codev/SecurityAdvisoryDosAttackWithInclude · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25445 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-1387 · Nota de Segurança
• http://securityfocus.com/bid/17267 · Nota
• http://vupen.com/english/advisories/2006/1116 · Nota
• http://secunia.com/advisories/19410 · Nota