PT-2006-3849 · Twiki · Twiki

Harald Joerg · Published 2006-06-20 · Updated 2017-07-20 · CVE-2006-2942

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TWiki versions 4.0.0 through 4.0.2

Description The issue allows remote attackers to gain administrator privileges by modifying the action attribute in the TWiki.TWikiRegistration form to reference the Sandbox web instead of the user web. This can be used to associate a user's login name with the WikiName of a member of the TWikiAdminGroup.

Recommendations For TWiki versions 4.0.0 through 4.0.2, consider restricting access to the TWiki.TWikiRegistration form until a fix is available. As a temporary workaround, restrict the ability to modify the action attribute in this form to prevent unauthorized access to administrator privileges.

Fix

Related Identifiers

CVE-2006-2942

Affected Products

Twiki

References · 10

• http://twiki.org/cgi-bin/view/Codev/SecurityAlertTWiki4PrivilegeElevation · Vendor Advisory
• http://securitytracker.com/id?1016323 · Patch
• http://secunia.com/advisories/20596 · Vendor Advisory
• http://securityfocus.com/bid/18506 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-2942 · Security Note
• http://vupen.com/english/advisories/2006/2415 · Note
• http://archives.neohapsis.com/archives/vulnwatch/2006-q2/0032.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2942 · Note
• http://osvdb.org/26623 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27336 · Note