NVD

Id
34657  
Name
CVE-2014-7237  
Description
lib/TWiki/Sandbox.pm in TWiki 6.0.0 and earlier, when running on Windows, allows remote attackers to bypass intended access restrictions and upload files with restricted names via a null byte (%00) in a filename to bin/upload.cgi, as demonstrated using .htaccess to execute arbitrary code.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2014-10-15  
Modified Date
2014-10-22  
Seq
2014-7237  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
178659 34657 CVE-2014-7237 20141009 TWiki Security Alert CVE-2014-7237: Apache configuration file upload on TWiki on Windows server  View
178660 34657 CVE-2014-7237 http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2014-7237  View
178661 34657 CVE-2014-7237 1030982  View
178662 34657 CVE-2014-7237 twiki-cve20147237-file-upload(96952)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
16175 JVNDB-2014-005050 TWiki の lib/TWiki/Sandbox.pm におけるアクセス制限を回避される脆弱性 TWiki の lib/TWiki/Sandbox.pm には、Windows 上で稼動する場合、アクセス制限を回避される、および制限された名前を持つファイルをアップロードされる脆弱性が存在します。 CVE-2014-7237 74530 CVE-2014-7237 34657 6.8 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-005050.html 2014-10-01 2014-10-28 View