CVE-2012-6330 The localization functionality in TWiki before 5.1.3, and Foswiki 1.0.x through 1.0.10 and 1.1.x through 1.1.6, allows remote attackers to cause a denial of service (memory consumption) via a large in...
MediumCVSS 5.0
EPSS 35.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The localization functionality in TWiki before 5.1.3, and Foswiki 1.0.x through 1.0.10 and 1.1.x through 1.1.6, allows remote attackers to cause a denial of service (memory consumption) via a large integer in a %MAKETEXT% macro.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| twiki | <= 5.1.2 | No fix listed |
| twiki | = 5.1.0 | No fix listed |
| twiki | = 5.1.1 | No fix listed |
| foswiki | = 1.0.0 | No fix listed |
| foswiki | = 1.0.1 | No fix listed |
| foswiki | = 1.0.2 | No fix listed |
| foswiki | = 1.0.3 | No fix listed |
| foswiki | = 1.0.4 | No fix listed |
| foswiki | = 1.0.10 | No fix listed |
| foswiki | = 1.1.0 | No fix listed |
| foswiki | = 1.1.1 | No fix listed |
| foswiki | = 1.1.2 | No fix listed |
| foswiki | = 1.1.3 | No fix listed |
| foswiki | = 1.1.4 | No fix listed |
| foswiki | = 1.1.5 | No fix listed |
| foswiki | = 1.1.6 | No fix listed |
References
- [foswiki-announce] 20121212 Security Alert CVE-2012-6329: Foswiki MAKETEXT Variable Allows Arbitrary Shell Command Execution mailing-list
- twiki.org vendor-advisory
- 56950 vdb-entry