PT-2006-4560 · Edgewall · Trac

Published 2006-07-19 · Updated 2022-05-01 · CVE-2006-3695

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Trac versions prior to 0.9.6

Description The issue allows remote attackers to read arbitrary files, perform cross-site scripting (XSS) attacks, or cause a denial of service via unspecified vectors. This is due to the failure to disable the "raw" or "include" commands when providing untrusted users with restructured text (reStructuredText) functionality from docutils.

Recommendations For versions prior to 0.9.6, update to version 0.9.6 or later to resolve the issue. As a temporary workaround, consider disabling the restructured text functionality for untrusted users until a patch is available. Restrict access to sensitive files and directories to minimize the risk of exploitation.

Fix

Information Disclosure

Resource Exhaustion

Weakness Enumeration

CWE-200

CWE-400

Related Identifiers

CVE-2006-3695

DSA-1152

GHSA-R524-C2GF-5CHR

PYSEC-2006-2

Affected Products

Trac

References · 21

• https://osv.dev/vulnerability/PYSEC-2006-2 · Vendor Advisory
• http://secunia.com/advisories/20958 · Vendor Advisory
• http://secunia.com/advisories/21534 · Vendor Advisory
• http://debian.org/security/2006/dsa-1152 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-3695 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3695 · Security Note
• http://vupen.com/english/advisories/2006/2729 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2006-3695 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2006-3695 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r524-c2gf-5chr · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/trac/PYSEC-2006-2.yaml · Note
• http://trac.edgewall.org/wiki/ChangeLog · Note
• https://web.archive.org/web/20061227230548/http://trac.edgewall.org/wiki/ChangeLog · Note
• http://securityfocus.com/bid/18323 · Note
• http://securitytracker.com/id?1016457 · Note