CVE-2006-3336

2006-07-0500:00:00

ubuntu.com

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:P/A:N

0.021 Low

EPSS

Percentile

89.1%

JSON

TWiki 01-Dec-2000 up to 4.0.3 allows remote attackers to bypass the upload
filter and execute arbitrary code via filenames with double extensions such
as “.php.en”, “.php.1”, and other allowed extensions that are not .txt.
NOTE: this is only a vulnerability when the server allows script execution
in the pub directory.

OSVersionArchitecturePackageVersionFilename
ubuntu7.04noarchtwiki< 4.0.5-9.1ubuntu1UNKNOWN
ubuntu7.10noarchtwiki< 4.0.5-9.1ubuntu1UNKNOWN
ubuntu8.04noarchtwiki< 4.0.5-9.1ubuntu1UNKNOWN
ubuntu8.10noarchtwiki< 4.0.5-9.1ubuntu1UNKNOWN
ubuntu9.04noarchtwiki< 4.0.5-9.1ubuntu1UNKNOWN
ubuntu9.10noarchtwiki< 4.0.5-9.1ubuntu1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	7.04	noarch	twiki	< 4.0.5-9.1ubuntu1	UNKNOWN
ubuntu	7.10	noarch	twiki	< 4.0.5-9.1ubuntu1	UNKNOWN
ubuntu	8.04	noarch	twiki	< 4.0.5-9.1ubuntu1	UNKNOWN
ubuntu	8.10	noarch	twiki	< 4.0.5-9.1ubuntu1	UNKNOWN
ubuntu	9.04	noarch	twiki	< 4.0.5-9.1ubuntu1	UNKNOWN
ubuntu	9.10	noarch	twiki	< 4.0.5-9.1ubuntu1	UNKNOWN