Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2006-3336

Date: July 5, 2006

TWiki 01-Dec-2000 up to 4.0.3 allows remote attackers to bypass the upload filter and execute arbitrary code via filenames with double extensions such as ".php.en", ".php.1", and other allowed extensions that are not .txt. NOTE: this is only a vulnerability when the server allows script execution in the pub directory.

Severity Score

Related Resources (8)

http://secunia.com/advisories/20992
https://people.canonical.com/~ubuntu-security/cve/CVE-2006-3336
http://www.securityfocus.com/bid/18854
https://nvd.nist.gov/vuln/detail/CVE-2006-3336
http://twiki.org/cgi-bin/view/Codev/SecurityAlertSecureFileUploads
http://www.vupen.com/english/advisories/2006/2677
http://securitytracker.com/id?1016458
https://www.mend.io/vulnerability-database/CVE-2006-3336

Severity Score

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): HIGH
Authentication (AU): NONE
Confidentiality (C): PARTIAL
Integrity (I): PARTIAL
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us