CVE-2008-3195 Directory traversal vulnerability in bin/configure in TWiki before 4.2.3, when a certain step in the installation guide is skipped, allows remote attackers to read arbitrary files via a query string c...
MediumCVSS 6.8
EPSS 8.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Directory traversal vulnerability in bin/configure in TWiki before 4.2.3, when a certain step in the installation guide is skipped, allows remote attackers to read arbitrary files via a query string containing a .. (dot dot) in the image variable, and execute arbitrary files via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| twiki | <= 4.2.2 | No fix listed |
| twiki | = 4.0 | No fix listed |
| twiki | = 4.0.0 | No fix listed |
| twiki | = 4.0.1 | No fix listed |
| twiki | = 4.0.2 | No fix listed |
| twiki | = 4.0.3 | No fix listed |
| twiki | = 4.0.4 | No fix listed |
| twiki | = 4.0.5 | No fix listed |
| twiki | = 4.1.0 | No fix listed |
| twiki | = 4.1.1 | No fix listed |
| twiki | = 4.1.2 | No fix listed |
| twiki | = 4.2.0 | No fix listed |
| twiki | = 4.2.1 | No fix listed |
References
- 31849 third-party-advisory
- 31964 third-party-advisory
- 4265 third-party-advisory
- twiki.org patch
- twiki.org patch
- VU#362012 third-party-advisory us-government-resource
- www.kb.cert.org
- ADV-2008-2586 vdb-entry
- twiki-configure-directory-traversal(45182) vdb-entry
- twiki-configure-image-command-execution(45183) vdb-entry
- 6269 exploit