Lucene search
HistoryDec 21, 2006 - 1:28 a.m.
CVE-2006-6678
netrik
cve-2006-6678
command execution
shell metacharacters
security vulnerability
7.3 High
AI Score
Confidence
Low
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.005 Low
EPSS
Percentile
75.8%
The edit_textarea function in form-file.c in Netrik 1.15.4 and earlier does not properly verify temporary filenames when editing textarea fields, which allows attackers to execute arbitrary commands via shell metacharacters in the filename.
| CPE | Name | Operator | Version |
|---|---|---|---|
| netrik:netrik | netrik | eq | 1.15.2 |
| netrik:netrik | netrik | le | 1.15.4 |
Related
securityvulns
securityvulns
netrik shell characters problems
2007-01-21 00:00:00
debiancve
debiancve
CVE-2006-6678
2006-12-21 01:28:00
nessus
nessus
Debian DSA-1251-1 : netrick - insufficient escaping
2007-01-26 00:00:00
ubuntucve
ubuntucve
CVE-2006-6678
2006-12-21 00:00:00
debian
debian
osv
osv
netrik
2007-01-21 00:00:00
openvas
openvas
Debian Security Advisory DSA 1251-1 (netrik)
2008-01-17 00:00:00
Debian: Security Advisory (DSA-1251-1)
2008-01-17 00:00:00
7.3 High
AI Score
Confidence
Low
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.005 Low
EPSS
Percentile
75.8%
Related for CVE-2006-6678