CVE-2014-7236 : Eval injection vulnerability in lib/TWiki/Plugins.pm in TWiki before 6.0.1 allow

Eval injection vulnerability in lib/TWiki/Plugins.pm in TWiki before 6.0.1 allows remote attackers to execute arbitrary Perl code via the debugenableplugins parameter to do/view/Main/WebHome.

Published 2020-02-17 22:15:11

Updated 2020-02-20 15:23:28

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2014-7236

Twiki » Twiki
Versions from including (>=) 5.0 and up to, including, (<=) 5.0.2
cpe:2.3:a:twiki:twiki:*:*:*:*:*:*:*:*
Matching versions
Twiki » Twiki
Versions from including (>=) 4.3 and up to, including, (<=) 4.3.2
cpe:2.3:a:twiki:twiki:*:*:*:*:*:*:*:*
Matching versions
Twiki » Twiki
Versions from including (>=) 4.0 and up to, including, (<=) 4.0.5
cpe:2.3:a:twiki:twiki:*:*:*:*:*:*:*:*
Matching versions
Twiki » Twiki
Versions from including (>=) 5.1.0 and up to, including, (<=) 5.1.4
cpe:2.3:a:twiki:twiki:*:*:*:*:*:*:*:*
Matching versions
Twiki » Twiki
Versions from including (>=) 4.1 and up to, including, (<=) 4.1.2
cpe:2.3:a:twiki:twiki:*:*:*:*:*:*:*:*
Matching versions
Twiki » Twiki
Versions from including (>=) 4.2 and up to, including, (<=) 4.2.4
cpe:2.3:a:twiki:twiki:*:*:*:*:*:*:*:*
Matching versions
Twiki » Twiki » Version: 6.0
cpe:2.3:a:twiki:twiki:6.0:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2014-7236

EPSS FAQ

93.98%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2014-7236

TWiki Debugenableplugins Remote Code Execution

Disclosure Date: 2014-10-09

First seen: 2020-04-26

exploit/unix/http/twiki_debug_plugins

TWiki 4.0.x-6.0.0 contains a vulnerability in the Debug functionality. The value of the debugenableplugins parameter is used without proper sanitization in an Perl eval statement which allows remote code execution. Authors: - Netanel Rubin - h0ng10

More information

CVSS scores for CVE-2014-7236

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.4	MEDIUM	AV:N/AC:L/Au:N/C:P/I:P/A:N	10.0	4.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None
9.1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	3.9	5.2	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: None

CWE ids for CVE-2014-7236

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2014-7236

http://packetstormsecurity.com/files/128623/Twiki-Perl-Code-Execution.html

Twiki Perl Code Execution ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry
http://seclists.org/fulldisclosure/2014/Oct/44

Full Disclosure: TWiki Security Alert CVE-2014-7236: Remote Perl code execution with query string to debug TWiki plugins
Exploit;Mailing List;Third Party Advisory
http://www.securitytracker.com/id/1030981

TWiki debugenableplugins Parameter Lets Remote Users View and Modify Files - SecurityTracker
Third Party Advisory;VDB Entry
http://www.securityfocus.com/bid/70372

TWiki 'debugenableplugins' Parameter Remote Code Execution Vulnerability
Third Party Advisory;VDB Entry

Jump to