CVE-2006-3336
First published: Wed Jul 05 2006(Updated: )
TWiki 01-Dec-2000 up to 4.0.3 allows remote attackers to bypass the upload filter and execute arbitrary code via filenames with double extensions such as ".php.en", ".php.1", and other allowed extensions that are not .txt. NOTE: this is only a vulnerability when the server allows script execution in the pub directory.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Twiki Twiki | =2000-12-01 | |
| Twiki Twiki | =2004-09-02 | |
| Twiki Twiki | =4.0.1 | |
| Twiki Twiki | =2001-09-01 | |
| Twiki Twiki | =2003-02-01 | |
| Twiki Twiki | =4.0.3 | |
| Twiki Twiki | =4.0 | |
| Twiki Twiki | =2001-12-01 | |
| Twiki Twiki | =2004-09-04 | |
| Twiki Twiki | =2004-09-01 | |
| Twiki Twiki | =2004-09-03 | |
| Twiki Twiki | =4.0.0 | |
| Twiki Twiki | =4.0.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2006-3336?
CVE-2006-3336 has been classified as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2006-3336?
To fix CVE-2006-3336, you should upgrade to a fixed version of TWiki that addresses this vulnerability.
Which versions of TWiki are affected by CVE-2006-3336?
CVE-2006-3336 affects TWiki versions from 01-Dec-2000 up to 4.0.3.
Can CVE-2006-3336 be exploited remotely?
Yes, CVE-2006-3336 can be exploited by remote attackers to execute arbitrary code.
What types of filenames can exploit CVE-2006-3336?
Filenames with double extensions like '.php.en' or '.php.1' can exploit CVE-2006-3336 if the server allows script execution.
- collector/nvd-historical
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/remedy
- agent/author
- agent/references
- agent/tags
- agent/event
- agent/description
- agent/first-publish-date
- agent/source
- vendor/twiki
- canonical/twiki twiki
- version/twiki twiki/2000-12-01
- version/twiki twiki/2004-09-02
- version/twiki twiki/4.0.1
- version/twiki twiki/2001-09-01
- version/twiki twiki/2003-02-01
- version/twiki twiki/4.0.3
- version/twiki twiki/4.0
- version/twiki twiki/2001-12-01
- version/twiki twiki/2004-09-04
- version/twiki twiki/2004-09-01
- version/twiki twiki/2004-09-03
- version/twiki twiki/4.0.0
- version/twiki twiki/4.0.2