PT-2001-1202 · Twig · Twig

Published 2001-01-09 · Updated 2017-10-10 · CVE-2000-1166

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Twig webmail system (affected versions not specified)

Description The issue concerns the Twig webmail system, which fails to properly set the vhosts variable when it is not configured. This allows remote attackers to insert arbitrary PHP code by specifying an alternate vhosts as an argument to the index.php3 program.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2000-1166

Affected Products

Twig

References · 5

• http://archives.neohapsis.com/archives/bugtraq/2000-11/0351.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2000-1166 · Security Note
• http://securityfocus.com/bid/1998 · Vendor Advisory
• http://twig.screwdriver.net/file.php3?file=CHANGELOG · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5581 · Note