Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Informations | |||
|---|---|---|---|
| Name | CVE-2008-3195 | First vendor Publication | 2008-09-18 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 6.8 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Directory traversal vulnerability in bin/configure in TWiki before 4.2.3, when a certain step in the installation guide is skipped, allows remote attackers to read arbitrary files via a query string containing a .. (dot dot) in the image variable, and execute arbitrary files via unspecified vectors. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3195 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:20275 | |||
| Oval ID: | oval:org.mitre.oval:def:20275 | ||
| Title: | DSA-1639-1 twiki - command execution | ||
| Description: | It was discovered that twiki, a web based collaboration platform, didn't properly sanitise the image parameter in its configuration script. This could allow remote users to execute arbitrary commands upon the system, or read any files which were readable by the webserver user. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1639-1 CVE-2008-3195 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | twiki |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:7915 | |||
| Oval ID: | oval:org.mitre.oval:def:7915 | ||
| Title: | DSA-1639 twiki -- command execution | ||
| Description: | It was discovered that twiki, a web based collaboration platform, didn't properly sanitise the image parameter in its configuration script. This could allow remote users to execute arbitrary commands upon the system, or read any files which were readable by the webserver user. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1639 CVE-2008-3195 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | twiki |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
ExploitDB Exploits
| id | Description |
|---|---|
| 2008-09-21 | TWiki <= 4.2.2 (action) Remote Code Execution Vulnerability |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2008-09-24 | Name : Debian Security Advisory DSA 1639-1 (twiki) File : nvt/deb_1639_1.nasl |
| 2008-09-17 | Name : FreeBSD Ports: twiki File : nvt/freebsd_twiki1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 48221 | TWiki bin/configure image Parameter Traversal Arbitrary File Access/Execution |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2008-09-22 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1639.nasl - Type : ACT_GATHER_INFO |
| 2008-09-15 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_9227dcaf827f11dd9cd70050568452ac.nasl - Type : ACT_GATHER_INFO |
| 2008-08-23 | Name : The remote web server hosts a CGI script that is affected by multiple vulnera... File : twiki_image_dir_traversal.nasl - Type : ACT_ATTACK |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:13:30 |
|
| 2024-11-28 12:16:04 |
|
| 2021-05-04 12:07:48 |
|
| 2021-04-22 01:08:11 |
|
| 2020-05-23 01:39:43 |
|
| 2020-05-23 00:21:59 |
|
| 2017-09-29 09:23:38 |
|
| 2017-08-08 09:24:14 |
|
| 2016-04-26 17:38:41 |
|
| 2014-02-17 10:45:44 |
|
| 2013-05-11 00:21:38 |
|
