CVE-2014-7236 Eval injection vulnerability in lib/TWiki/Plugins.pm in TWiki before 6.0.1 allows remote attackers to execute arbitrary Perl code via the debugenableplugins parameter to do/view/Main/WebHome.
CriticalCVSS 9.1
EPSS 55.6%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Eval injection vulnerability in lib/TWiki/Plugins.pm in TWiki before 6.0.1 allows remote attackers to execute arbitrary Perl code via the debugenableplugins parameter to do/view/Main/WebHome.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| twiki | >= 4.0, <= 4.0.5 | No fix listed |
| twiki | >= 4.1, <= 4.1.2 | No fix listed |
| twiki | >= 4.2, <= 4.2.4 | No fix listed |
| twiki | >= 4.3, <= 4.3.2 | No fix listed |
| twiki | >= 5.0, <= 5.0.2 | No fix listed |
| twiki | >= 5.1.0, <= 5.1.4 | No fix listed |
| twiki | = 6.0 | No fix listed |
References
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- seclists.org exploit mailing-list third-party-advisory
- 70372 third-party-advisory vdb-entry
- www.securitytracker.com third-party-advisory vdb-entry