Home > Vulnerability Database > CVE-2006-6678

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2006-6678

Date: December 20, 2006

The edit_textarea function in form-file.c in Netrik 1.15.4 and earlier does not properly verify temporary filenames when editing textarea fields, which allows attackers to execute arbitrary commands via shell metacharacters in the filename.

Severity Score

7.3

Related Resources (9)

Url: http://www.securityfocus.com/bid/22158

Url: http://secunia.com/advisories/23822

Url: http://www.debian.org/security/2007/dsa-1251

Url: https://nvd.nist.gov/vuln/detail/CVE-2006-6678

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2006-6678

Url: http://sourceforge.net/project/shownotes.php?release_id=472131&group_id=23183

Url: http://netrik.cvs.sourceforge.net/netrik/netrik/form-file.c?r1=1.3&r2=1.4

Url: http://www.vupen.com/english/advisories/2006/5092

Url: https://www.mend.io/vulnerability-database/CVE-2006-6678

Severity Score

7.3

CVSS v3.1

Base Score:	7.3
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	LOW

CVSS v2

Base Score:	7.5
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

Do you need more information?

Contact Us