NVD

Id
62363  
Name
CVE-2006-3695  
Description
Trac before 0.9.6 does not disable the "raw" or "include" commands when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows remote attackers to read arbitrary files, perform cross-site scripting (XSS) attacks, or cause a denial of service via unspecified vectors. NOTE: this might be related to CVE-2006-3458.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2016-12-20  
Published
2006-07-21  
Modified Date
2011-03-16  
Seq
2006-3695  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
323261 62363 CVE-2006-3695 1016457  View
323262 62363 CVE-2006-3695 http://trac.edgewall.org/wiki/ChangeLog  View
323263 62363 CVE-2006-3695 DSA-1152  View
323264 62363 CVE-2006-3695 18323  View
323265 62363 CVE-2006-3695 ADV-2006-2729  View
323266 62363 CVE-2006-3695 trac-restructuredtext-obtain-information(27706)  View
323267 62363 CVE-2006-3695 trac-restructuredtext-dos(27708)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
60551 JVNDB-2006-002817 Trac における任意のファイルを読まれるなどの脆弱性 Trac は、信頼されないユーザに docutils から再編されたテキスト (reStructuredText) 機能を提供する際、"raw" または "include" コマンドを無効にしないため、任意のファイルを読まれる、クロスサイトスクリプト攻撃を実行される、またはサービス運用妨害 (DoS) 状態となる脆弱性が存在します。 CVE-2006-3695 19797 CVE-2006-3695 62363 6.8 http://jvndb.jvn.jp/ja/contents/2006/JVNDB-2006-002817.html 2006-07-21 2012-12-20 View