PT-2006-6716 · Apache+1 · Apache+1

George Clark · Publicado 2006-12-02 · Atualizado 2017-07-20 · CVE-2006-6071

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TWiki versions 4.0.5 and earlier

Description The issue arises when TWiki is running under Apache 1.3, using ApacheLogin with sessions, and "ErrorDocument 401" redirects to a valid wiki topic. In this setup, failed login attempts are not properly handled, allowing remote attackers to read arbitrary content. This can be achieved by cancelling out of a failed authentication with a valid username and an invalid password.

Recommendations For TWiki versions 4.0.5 and earlier, consider updating to a version that properly handles failed login attempts to prevent unauthorized access to content. As a temporary workaround, restrict access to sensitive wiki topics until a proper fix is applied.

Correção

Identificadores relacionados

CVE-2006-6071

Produtos afetados

Apache

Twiki

Referências · 7

• http://securityfocus.com/bid/21381 · Nota
• http://secunia.com/advisories/23189 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30667 · Nota
• http://vupen.com/english/advisories/2006/4790 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6071 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6071 · Nota
• http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2006-6071 · Nota