PT-2006-2396 · Twiki · Twiki

Kenneth Lavrsen · Published 2006-03-26 · Updated 2017-07-20 · CVE-2006-1387

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions TWiki versions 20010901 through 20040904 TWiki version 4.0 TWiki version 4.0.1

Description The issue allows remote authenticated users with edit rights to cause a denial of service. This is achieved through INCLUDE by URL statements that form a loop, such as a page that includes itself, leading to infinite recursion and consumption of CPU and memory.

Recommendations For TWiki versions 20010901 through 20040904, consider restricting the use of INCLUDE by URL statements to prevent loops. For TWiki version 4.0, avoid using self-including pages to minimize the risk of exploitation. For TWiki version 4.0.1, restrict access to edit rights to minimize the potential for denial of service attacks.

Fix

Related Identifiers

CVE-2006-1387

Affected Products

Twiki

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2006-1387 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1387 · Note
• http://twiki.org/cgi-bin/view/Codev/SecurityAdvisoryDosAttackWithInclude · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25445 · Note
• http://securityfocus.com/bid/17267 · Note
• http://vupen.com/english/advisories/2006/1116 · Note
• http://secunia.com/advisories/19410 · Note