TWiki Homepage Creation Privilege Escalation Vulnerability
BID:18506
CVE-2006-2942 |Info
TWiki Homepage Creation Privilege Escalation Vulnerability
| Bugtraq ID: | 18506 |
| Class: | Design Error |
| CVE: |
CVE-2006-2942 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 19 2006 12:00AM |
| Updated: | Jun 20 2006 05:00PM |
| Credit: | The vendor credits Harald Jörg with the discovery of this vulnerability. |
| Vulnerable: |
TWiki TWiki 4.0.2 TWiki TWiki 4.0.1 TWiki TWiki 0 |
| Not Vulnerable: | |
Discussion
TWiki Homepage Creation Privilege Escalation Vulnerability
TWiki is prone to a vulnerability that could permit privilege escalation. This issue is due to a design error in the application; it fails to properly reset security settings.
An attacker with a valid account can exploit this vulnerability to elevate privileges to that of an administrator of the application. This may permit the attacker to alter site content; other attacks are also possible.
TWiki is prone to a vulnerability that could permit privilege escalation. This issue is due to a design error in the application; it fails to properly reset security settings.
An attacker with a valid account can exploit this vulnerability to elevate privileges to that of an administrator of the application. This may permit the attacker to alter site content; other attacks are also possible.
Exploit / POC
TWiki Homepage Creation Privilege Escalation Vulnerability
This issue can be exploited through a web client.
This issue can be exploited through a web client.
Solution / Fix
TWiki Homepage Creation Privilege Escalation Vulnerability
Solution:
The vendor has released a hotfix for all released versions of TWiki 4.0.X; please see the reference section for details.
TWiki TWiki 0
TWiki TWiki 4.0.1
TWiki TWiki 4.0.2
Solution:
The vendor has released a hotfix for all released versions of TWiki 4.0.X; please see the reference section for details.
TWiki TWiki 0
-
TWiki Twiki Patch (diff file) for versions 4.0.0, 4.0.1, and 4.0.2
http://twiki.org/p/pub/Codev/SecurityAlertTWiki4PrivilegeElevation/CVE -2006-2942-hotfix-4.0.0-4.0.2.diff
TWiki TWiki 4.0.1
-
TWiki Twiki Patch (diff file) for versions 4.0.0, 4.0.1, and 4.0.2
http://twiki.org/p/pub/Codev/SecurityAlertTWiki4PrivilegeElevation/CVE -2006-2942-hotfix-4.0.0-4.0.2.diff
TWiki TWiki 4.0.2
-
TWiki Twiki Patch (diff file) for versions 4.0.0, 4.0.1, and 4.0.2
http://twiki.org/p/pub/Codev/SecurityAlertTWiki4PrivilegeElevation/CVE -2006-2942-hotfix-4.0.0-4.0.2.diff
References
TWiki Homepage Creation Privilege Escalation Vulnerability
References:
References: