GSD-2006-6690

Vulnerability from gsd - Updated: 2023-12-13 01:19
Details
rtehtmlarea/pi1/class.tx_rtehtmlarea_pi1.php in Typo3 4.0.0 through 4.0.3, 3.7 and 3.8 with the rtehtmlarea extension, and 4.1 beta allows remote authenticated users to execute arbitrary commands via shell metacharacters in the userUid parameter to rtehtmlarea/htmlarea/plugins/SpellChecker/spell-check-logic.php, and possibly another vector.
Aliases
Aliases
CVE-2006-6690
To clipboard 

{
  "GSD": {
    "alias": "CVE-2006-6690",
    "description": "rtehtmlarea/pi1/class.tx_rtehtmlarea_pi1.php in Typo3 4.0.0 through 4.0.3, 3.7 and 3.8 with the rtehtmlarea extension, and 4.1 beta allows remote authenticated users to execute arbitrary commands via shell metacharacters in the userUid parameter to rtehtmlarea/htmlarea/plugins/SpellChecker/spell-check-logic.php, and possibly another vector.",
    "id": "GSD-2006-6690"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2006-6690"
      ],
      "details": "rtehtmlarea/pi1/class.tx_rtehtmlarea_pi1.php in Typo3 4.0.0 through 4.0.3, 3.7 and 3.8 with the rtehtmlarea extension, and 4.1 beta allows remote authenticated users to execute arbitrary commands via shell metacharacters in the userUid parameter to rtehtmlarea/htmlarea/plugins/SpellChecker/spell-check-logic.php, and possibly another vector.",
      "id": "GSD-2006-6690",
      "modified": "2023-12-13T01:19:54.526174Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2006-6690",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "rtehtmlarea/pi1/class.tx_rtehtmlarea_pi1.php in Typo3 4.0.0 through 4.0.3, 3.7 and 3.8 with the rtehtmlarea extension, and 4.1 beta allows remote authenticated users to execute arbitrary commands via shell metacharacters in the userUid parameter to rtehtmlarea/htmlarea/plugins/SpellChecker/spell-check-logic.php, and possibly another vector."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "20061220 SEC Consult SA-20061220-0 :: Typo3 Command Execution Vulnerability",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/454944/100/0/threaded"
          },
          {
            "name": "23466",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/23466"
          },
          {
            "name": "http://www.sec-consult.com/272.html",
            "refsource": "MISC",
            "url": "http://www.sec-consult.com/272.html"
          },
          {
            "name": "[TYPO3-announce] 20061219 Pre-announcement for important security update",
            "refsource": "MLIST",
            "url": "http://lists.netfielders.de/pipermail/typo3-announce/2006/000045.html"
          },
          {
            "name": "1017428",
            "refsource": "SECTRACK",
            "url": "http://securitytracker.com/id?1017428"
          },
          {
            "name": "2056",
            "refsource": "SREASON",
            "url": "http://securityreason.com/securityalert/2056"
          },
          {
            "name": "[TYPO3-announce] 20061220 TYPO3 Security Bulletin TYPO3-20061220-1: Remote Command Execution in TYPO3",
            "refsource": "MLIST",
            "url": "http://lists.netfielders.de/pipermail/typo3-announce/2006/000046.html"
          },
          {
            "name": "23446",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/23446"
          },
          {
            "name": "http://typo3.org/news-single-view/?tx_newsimporter_pi1%5BshowItem%5D=0\u0026cHash=e4a40a11a9",
            "refsource": "CONFIRM",
            "url": "http://typo3.org/news-single-view/?tx_newsimporter_pi1%5BshowItem%5D=0\u0026cHash=e4a40a11a9"
          },
          {
            "name": "ADV-2006-5094",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2006/5094"
          },
          {
            "name": "21680",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/21680"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:typo3:typo3:4.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typo3:typo3:4.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typo3:typo3:3.7.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typo3:typo3:3.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typo3:typo3:4.0.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typo3:typo3:4.0.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-6690"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "rtehtmlarea/pi1/class.tx_rtehtmlarea_pi1.php in Typo3 4.0.0 through 4.0.3, 3.7 and 3.8 with the rtehtmlarea extension, and 4.1 beta allows remote authenticated users to execute arbitrary commands via shell metacharacters in the userUid parameter to rtehtmlarea/htmlarea/plugins/SpellChecker/spell-check-logic.php, and possibly another vector."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-Other"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[TYPO3-announce] 20061219 Pre-announcement for important security update",
              "refsource": "MLIST",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://lists.netfielders.de/pipermail/typo3-announce/2006/000045.html"
            },
            {
              "name": "[TYPO3-announce] 20061220 TYPO3 Security Bulletin TYPO3-20061220-1: Remote Command Execution in TYPO3",
              "refsource": "MLIST",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://lists.netfielders.de/pipermail/typo3-announce/2006/000046.html"
            },
            {
              "name": "http://www.sec-consult.com/272.html",
              "refsource": "MISC",
              "tags": [
                "Exploit"
              ],
              "url": "http://www.sec-consult.com/272.html"
            },
            {
              "name": "21680",
              "refsource": "BID",
              "tags": [
                "Exploit",
                "Patch"
              ],
              "url": "http://www.securityfocus.com/bid/21680"
            },
            {
              "name": "http://typo3.org/news-single-view/?tx_newsimporter_pi1%5BshowItem%5D=0\u0026cHash=e4a40a11a9",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://typo3.org/news-single-view/?tx_newsimporter_pi1%5BshowItem%5D=0\u0026cHash=e4a40a11a9"
            },
            {
              "name": "1017428",
              "refsource": "SECTRACK",
              "tags": [
                "Exploit",
                "Patch"
              ],
              "url": "http://securitytracker.com/id?1017428"
            },
            {
              "name": "23446",
              "refsource": "SECUNIA",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/23446"
            },
            {
              "name": "23466",
              "refsource": "SECUNIA",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/23466"
            },
            {
              "name": "2056",
              "refsource": "SREASON",
              "tags": [],
              "url": "http://securityreason.com/securityalert/2056"
            },
            {
              "name": "ADV-2006-5094",
              "refsource": "VUPEN",
              "tags": [],
              "url": "http://www.vupen.com/english/advisories/2006/5094"
            },
            {
              "name": "20061220 SEC Consult SA-20061220-0 :: Typo3 Command Execution Vulnerability",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/454944/100/0/threaded"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": true,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2018-10-17T21:49Z",
      "publishedDate": "2006-12-21T21:28Z"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.