|
|
Family: CGI abuses --> Category: infos
TWiki filename Parameter Directory Traversal Vulnerability Vulnerability Scan
Vulnerability Scan Summary
Tries to read a local file with TWiki
Detailed Explanation for this Vulnerability Test
Synopsis :
The remote web server contains a Perl script that is prone to a
directory traversal attack.
Description :
The version of TWiki on the remote host allows directory traversal
sequences in the 'filename' parameter in the 'viewfile' function of
'lib/TWiki/UI/View.pm'. An unauthenticated attacker can leverage this
flaw to view arbitrary files on the remote host subject to the
rights of the web server user id.
See also :
http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2006-4294
http://sourceforge.net/mailarchive/forum.php?thread_id=30468855&forum_id=3703
Solution :
Apply Hotfix 3 for TWiki-4.0.4.
Threat Level:
Low / CVSS Base Score : 2
(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)
Click HERE for more information and discussions on this network vulnerability scan.
|
