« Volver al listado

CVE-2008-3195

Estado: ModificadaMedia (6.8)—

Directory traversal vulnerability in bin/configure in TWiki before 4.2.3, when a certain step in the installation guide is skipped, allows remote attackers to read arbitrary files via a query string containing a .. (dot dot) in the image variable, and execute arbitrary files via unspecified vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Twiki — Twiki

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-3195",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-09-18T15:04:27.233",
  "references": [
    {
      "url": "http://secunia.com/advisories/31849",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/31964",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/4265",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2008-3195",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://twiki.org/cgi-bin/view/Codev/TWikiRelease04x02x03#4_2_3_Bugfix_Highlights",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/362012",
      "tags": [
        "US Government Resource"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/RGII-7JEQ7L",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/2586",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45182",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45183",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/6269",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/31849",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/31964",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securityreason.com/securityalert/4265",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2008-3195",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://twiki.org/cgi-bin/view/Codev/TWikiRelease04x02x03#4_2_3_Bugfix_Highlights",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/362012",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/RGII-7JEQ7L",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/2586",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45182",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45183",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/6269",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Directory traversal vulnerability in bin/configure in TWiki before 4.2.3, when a certain step in the installation guide is skipped, allows remote attackers to read arbitrary files via a query string containing a .. (dot dot) in the image variable, and execute arbitrary files via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de salto de directorio en bin/configure en TWiki anterior a v4.2.3, cuando algún paso en el asistente de instalación es omitido, permite a atacantes remotos leer ficheros de su elección a través de una cadena de consulta que contiene ..(punto punto) en la variable \"image\", y ejecutar archivos de su elección a través de vectores no especificados."
    }
  ],
  "lastModified": "2026-06-16T22:55:20.267",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:twiki:twiki:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "92E06542-B556-44C0-901A-0380F09741DE",
              "versionEndIncluding": "4.2.2"
            },
            {
              "criteria": "cpe:2.3:a:twiki:twiki:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A0E0A8F3-02EE-4A6D-BAAC-1D52DF063197"
            },
            {
              "criteria": "cpe:2.3:a:twiki:twiki:4.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F893E121-82FA-41C8-9BA4-606E6DA01408"
            },
            {
              "criteria": "cpe:2.3:a:twiki:twiki:4.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "47807C3A-8430-48E3-A7C8-C5A1FEDF84C0"
            },
            {
              "criteria": "cpe:2.3:a:twiki:twiki:4.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "620356EA-F106-41DF-AADA-C1EF5A5A0829"
            },
            {
              "criteria": "cpe:2.3:a:twiki:twiki:4.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "979D8BC8-0032-496F-9503-F3BBBC8FA7CF"
            },
            {
              "criteria": "cpe:2.3:a:twiki:twiki:4.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0804FF93-6554-4F56-9974-017198ED5F44"
            },
            {
              "criteria": "cpe:2.3:a:twiki:twiki:4.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "41445C95-0309-4B90-B725-87D2FE87C9A5"
            },
            {
              "criteria": "cpe:2.3:a:twiki:twiki:4.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C9996E5B-36AD-407F-B3B6-839CE8E5913E"
            },
            {
              "criteria": "cpe:2.3:a:twiki:twiki:4.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "748325A4-A237-498A-A185-905FC921D2A3"
            },
            {
              "criteria": "cpe:2.3:a:twiki:twiki:4.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9FE3EEC6-7E05-4A37-97AA-D73E7D7A0E01"
            },
            {
              "criteria": "cpe:2.3:a:twiki:twiki:4.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "855671F5-C215-4382-B512-4ABD9D66F13D"
            },
            {
              "criteria": "cpe:2.3:a:twiki:twiki:4.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E9C00515-CFEE-427A-BACE-B3140B0D6C67"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}