PT-2006-4560 · Edgewall · Trac

Publicado 2006-07-19 · Atualizado 2022-05-01 · CVE-2006-3695

Positive Technologies (AI Summary)

CVSS v4.0

8.8

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Trac versions prior to 0.9.6

Description The issue allows remote attackers to read arbitrary files, perform cross-site scripting (XSS) attacks, or cause a denial of service via unspecified vectors. This is due to the failure to disable the "raw" or "include" commands when providing untrusted users with restructured text (reStructuredText) functionality from docutils.

Recommendations For versions prior to 0.9.6, update to version 0.9.6 or later to resolve the issue. As a temporary workaround, consider disabling the restructured text functionality for untrusted users until a patch is available. Restrict access to sensitive files and directories to minimize the risk of exploitation.

Correção

Information Disclosure

Resource Exhaustion

Enumeração de Fraquezas

CWE-200

CWE-400

Identificadores relacionados

CVE-2006-3695

DSA-1152

GHSA-R524-C2GF-5CHR

PYSEC-2006-2

Produtos afetados

Trac

Referências · 21

• https://github.com/pypa/advisory-database/tree/main/vulns/trac/PYSEC-2006-2.yaml · Nota
• http://trac.edgewall.org/wiki/ChangeLog · Nota
• https://osv.dev/vulnerability/PYSEC-2006-2 · Aviso do Fabricante
• https://web.archive.org/web/20061227230548/http://trac.edgewall.org/wiki/ChangeLog · Nota
• http://securityfocus.com/bid/18323 · Nota
• http://securitytracker.com/id?1016457 · Nota
• http://secunia.com/advisories/20958 · Aviso do Fabricante
• https://web.archive.org/web/20140806223337/http://secunia.com/advisories/20958 · Nota
• http://secunia.com/advisories/21534 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27706 · Nota
• http://debian.org/security/2006/dsa-1152 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-3695 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-3695 · Nota de Segurança
• https://web.archive.org/web/20140804165436/http://secunia.com/advisories/21534 · Nota
• http://vupen.com/english/advisories/2006/2729 · Aviso do Fabricante