Unscored severity · published Jul 27, 2006
CVE-2006-3819
Eval injection vulnerability in the configure script in TWiki 4.0.0 through 4.0.4 allows remote attackers to execute arbitrary Perl code via an HTTP POST request containing a…
–
CVSS
4.1%
EPSS
No
On KEV
Description
Eval injection vulnerability in the configure script in TWiki 4.0.0 through 4.0.4 allows remote attackers to execute arbitrary Perl code via an HTTP POST request containing a parameter name starting with "TYPEOF".
Exploitation
Is it being used?
Exploit prediction (EPSS)4.1% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TW
Twiki · Twiki
4.0; 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-3819
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-3819
secunia.com
http://secunia.com/advisories/21235
securitytracker.com
http://securitytracker.com/id?1016603
Exploit
http://twiki.org/cgi-bin/view/Codev/SecurityAlertCmdExecWithConfigure
www.osvdb.org
http://www.osvdb.org/displayvuln.php?osvdb_id=27556
www.securityfocus.com
http://www.securityfocus.com/bid/19188
www.vupen.com
http://www.vupen.com/english/advisories/2006/2995
More from Twiki
9.8
CVE-2013-1751
TWiki before 5.1.4 allows remote attackers to execute arbitrary shell commands by sending a crafted '%MAKETEXT{}%' parameter value containing Perl backtick characters
9.8
CVE-2005-3056
TWiki allows arbitrary shell command execution via the Include function
9.1
CVE-2014-7236
Eval injection vulnerability in lib/TWiki/Plugins.pm in TWiki before 6.0.1 allows remote attackers to execute arbitrary Perl code via the debugenableplugins parameter to…
6.1
CVE-2018-20212
bin/statistics in TWiki 6.0.2 allows cross-site scripting (XSS) via the webs parameter
–
CVE-2014-9367
Incomplete blacklist vulnerability in the urlEncode function in lib/TWiki.pm in TWiki 6.0.0 and 6.0.1 allows remote attackers to conduct cross-site scripting (XSS) attacks via a…