PT-2006-3849 · Twiki · Twiki

Harald Joerg · Publicado 2006-06-20 · Atualizado 2017-07-20 · CVE-2006-2942

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TWiki versions 4.0.0 through 4.0.2

Description The issue allows remote attackers to gain administrator privileges by modifying the action attribute in the TWiki.TWikiRegistration form to reference the Sandbox web instead of the user web. This can be used to associate a user's login name with the WikiName of a member of the TWikiAdminGroup.

Recommendations For TWiki versions 4.0.0 through 4.0.2, consider restricting access to the TWiki.TWikiRegistration form until a fix is available. As a temporary workaround, restrict the ability to modify the action attribute in this form to prevent unauthorized access to administrator privileges.

Correção

Identificadores relacionados

CVE-2006-2942

Produtos afetados

Twiki

Referências · 10

• http://vupen.com/english/advisories/2006/2415 · Nota
• http://archives.neohapsis.com/archives/vulnwatch/2006-q2/0032.html · Nota
• http://twiki.org/cgi-bin/view/Codev/SecurityAlertTWiki4PrivilegeElevation · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2942 · Nota
• http://securitytracker.com/id?1016323 · Correção
• http://osvdb.org/26623 · Nota
• http://secunia.com/advisories/20596 · Aviso do Fabricante
• http://securityfocus.com/bid/18506 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27336 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2942 · Nota de Segurança