CVE-2006-1387: Medium severity Twiki TWiki vulnerability

Published Mar 26, 2006

Updated

TWiki 4.0, 4.0.1, and 20010901 through 20040904 allows remote authenticated users with edit rights to cause a denial of service (infinite recursion leading to CPU and memory consumption) via INCLUDE by URL statements that form a loop, such as a page that includes itself.

Affected Software

9 affected components

Twiki TWiki=2004-09-02

Twiki TWiki=4.0.1

Twiki TWiki=2001-09-01

Twiki TWiki=2003-02-01

Twiki TWiki=4.0

Twiki TWiki=2001-12-01

Twiki TWiki=2004-09-04

Twiki TWiki=2004-09-01

Twiki TWiki=2004-09-03

Event History

Mar 26, 2006

CVE Published

10:02 PM

Mar 27, 2006

CVE Published

via MITRE·03:00 AM

Data Sourced

via MITRE·03:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-1387?

CVE-2006-1387 has a moderate severity level as it allows for denial of service through infinite recursion.

How do I fix CVE-2006-1387?

To fix CVE-2006-1387, you should upgrade to a patched version of TWiki that resolves the infinite recursion issue.

Which versions of TWiki are affected by CVE-2006-1387?

CVE-2006-1387 affects TWiki versions 4.0, 4.0.1, and various versions from 2001-09-01 to 2004-09-04.

What type of attack does CVE-2006-1387 enable?

CVE-2006-1387 enables a denial of service attack through crafted INCLUDE by URL statements that create loops.

Who can exploit CVE-2006-1387?

Remote authenticated users with edit rights can exploit CVE-2006-1387 to cause a denial of service.