CVE-2006-3336
Summary
| CVE | CVE-2006-3336 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2006-07-05 20:05:00 UTC |
| Updated | 2011-03-08 02:38:00 UTC |
| Description | TWiki 01-Dec-2000 up to 4.0.3 allows remote attackers to bypass the upload filter and execute arbitrary code via filenames with double extensions such as ".php.en", ".php.1", and other allowed extensions that are not .txt. NOTE: this is only a vulnerability when the server allows script execution in the pub directory. |
Risk And Classification
Problem Types: NVD-CWE-Other
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Twiki | Twiki | 2000-12-01 | All | All | All |
| Application | Twiki | Twiki | 2001-09-01 | All | All | All |
| Application | Twiki | Twiki | 2001-12-01 | All | All | All |
| Application | Twiki | Twiki | 2003-02-01 | All | All | All |
| Application | Twiki | Twiki | 2004-09-01 | All | All | All |
| Application | Twiki | Twiki | 2004-09-02 | All | All | All |
| Application | Twiki | Twiki | 2004-09-03 | All | All | All |
| Application | Twiki | Twiki | 2004-09-04 | All | All | All |
| Application | Twiki | Twiki | 4.0 | All | All | All |
| Application | Twiki | Twiki | 4.0.0 | All | All | All |
| Application | Twiki | Twiki | 4.0.1 | All | All | All |
| Application | Twiki | Twiki | 4.0.2 | All | All | All |
| Application | Twiki | Twiki | 4.0.3 | All | All | All |
| Application | Twiki | Twiki | 2000-12-01 | All | All | All |
| Application | Twiki | Twiki | 2001-09-01 | All | All | All |
| Application | Twiki | Twiki | 2001-12-01 | All | All | All |
| Application | Twiki | Twiki | 2003-02-01 | All | All | All |
| Application | Twiki | Twiki | 2004-09-01 | All | All | All |
| Application | Twiki | Twiki | 2004-09-02 | All | All | All |
| Application | Twiki | Twiki | 2004-09-03 | All | All | All |
| Application | Twiki | Twiki | 2004-09-04 | All | All | All |
| Application | Twiki | Twiki | 4.0 | All | All | All |
| Application | Twiki | Twiki | 4.0.0 | All | All | All |
| Application | Twiki | Twiki | 4.0.1 | All | All | All |
| Application | Twiki | Twiki | 4.0.2 | All | All | All |
| Application | Twiki | Twiki | 4.0.3 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| TWiki Arbitrary File Upload Vulnerability | BID | www.securityfocus.com | |
| SecurityAlertSecureFileUploads < Codev < TWiki | CONFIRM | twiki.org | Patch |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | VUPEN | www.vupen.com | |
| SecurityTracker.com Archives - TWiki PHP File Suffix Validation Bug Lets Remote Users Upload and Execute Arbitrary Code | SECTRACK | securitytracker.com | Exploit, Patch |
| TWiki Multiple File Extensions File Upload Vulnerability - Advisories - Secunia | SECUNIA | secunia.com | Patch, Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.