PT-2006-6716 · Apache+1 · Apache+1

George Clark · Published 2006-12-02 · Updated 2017-07-20 · CVE-2006-6071

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TWiki versions 4.0.5 and earlier

Description The issue arises when TWiki is running under Apache 1.3, using ApacheLogin with sessions, and "ErrorDocument 401" redirects to a valid wiki topic. In this setup, failed login attempts are not properly handled, allowing remote attackers to read arbitrary content. This can be achieved by cancelling out of a failed authentication with a valid username and an invalid password.

Recommendations For TWiki versions 4.0.5 and earlier, consider updating to a version that properly handles failed login attempts to prevent unauthorized access to content. As a temporary workaround, restrict access to sensitive wiki topics until a proper fix is applied.

Fix

Related Identifiers

CVE-2006-6071

Affected Products

Apache

Twiki

References · 7

• http://secunia.com/advisories/23189 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-6071 · Security Note
• http://securityfocus.com/bid/21381 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30667 · Note
• http://vupen.com/english/advisories/2006/4790 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6071 · Note
• http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2006-6071 · Note