Description
The (1) rdiff and (2) preview scripts in TWiki 4.0 and 4.0.1 ignore access control settings, which allows remote attackers to read restricted areas and access restricted content in TWiki topics.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25444 ↗
- http://www.securityfocus.com/bid/17268 ↗
- http://secunia.com/advisories/19410 ↗
- http://securitytracker.com/id?1015843 ↗
- http://www.vupen.com/english/advisories/2006/1116 ↗
- http://twiki.org/cgi-bin/view/Codev/SecurityAlertTWiki4RdiffPreviewAccess ↗