PT-2005-3740 · Twiki · Twiki

Sap · Published 2005-09-16 · Updated 2016-10-18 · CVE-2005-2877

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TWiki versions prior to 02-Sep-2004

Description The issue allows remote attackers to execute arbitrary code via shell metacharacters. This can be demonstrated via the rev parameter to the TWikiUsers function.

Recommendations For TWiki versions prior to 02-Sep-2004, update to a version released after 02-Sep-2004 to resolve the issue. As a temporary workaround, consider restricting access to the TWikiUsers function to minimize the risk of exploitation. Avoid using the rev parameter in the affected function until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2005-2877

Affected Products

Twiki

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/twiki_history.rb · Exploit
• 🔥 https://exploit-db.com/exploits/26260 · Exploit
• 🔥 http://securityfocus.com/bid/14834 · Exploit
• 🔥 https://exploit-db.com/exploits/16892 · Exploit
• 🔥 https://exploit-db.com/exploits/26302 · Exploit
• http://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithRev · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2877 · Security Note
• http://kb.cert.org/vuls/id/757181 · Patch
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2877 · Note
• http://marc.info/?l=bugtraq&m=112680475417550&w=2 · Note