Description
Directory traversal vulnerability in bin/configure in TWiki before 4.2.3, when a certain step in the installation guide is skipped, allows remote attackers to read arbitrary files via a query string containing a .. (dot dot) in the image variable, and execute arbitrary files via unspecified vectors.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://secunia.com/advisories/31849 ↗
- https://www.exploit-db.com/exploits/6269 ↗
- http://securityreason.com/securityalert/4265 ↗
- http://secunia.com/advisories/31964 ↗
- http://www.kb.cert.org/vuls/id/RGII-7JEQ7L ↗
- http://www.vupen.com/english/advisories/2008/2586 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45183 ↗
- http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2008-3195 ↗
- http://twiki.org/cgi-bin/view/Codev/TWikiRelease04x02x03#4_2_3_Bugfix_Highlights ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45182 ↗
- http://www.kb.cert.org/vuls/id/362012 ↗