TWiki ImageGalleryPlugin Configuration Options Remote Arbitrary Command Execution

Bugtraq ID:	12638
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 23 2005 12:00AM
Updated:	Feb 23 2005 12:00AM
Credit:	Florian Weimer is credited with the discovery of this issue.
Vulnerable:	TWiki TWiki 20040902 TWiki TWiki 20040901 TWiki TWiki 20030201 TWiki TWiki 01-Feb-2003
Not Vulnerable:

TWiki ImageGalleryPlugin Configuration Options Remote Arbitrary Command Execution

A remote command execution vulnerability affects the ImageGalleryPlugin of Twiki. This issue is due to a failure of the application to properly validate user access to sensitive configuration options.

An attacker may execute arbitrary commands, potentially compromising the host computer, by leveraging this issue.

TWiki ImageGalleryPlugin Configuration Options Remote Arbitrary Command Execution

No exploit is required to leverage this issue.

TWiki ImageGalleryPlugin Configuration Options Remote Arbitrary Command Execution

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

TWiki ImageGalleryPlugin Configuration Options Remote Arbitrary Command Execution

References:

• Increasing TWiki's Robustness Against Shell Command Injection (Florian Weimer)
  
• TWiki Homepage (TWiki)