CVE-2014-7237

lib/TWiki/Sandbox.pm in TWiki 6.0.0 and earlier, when running on Windows, allows remote attackers to bypass intended access restrictions and upload files with…

published October 16, 2014

CVSS
—
EPSS
20%
Percentile
97.4
In the wild
Unconfirmed
What it is

lib/TWiki/Sandbox.pm in TWiki 6.0.0 and earlier, when running on Windows, allows remote attackers to bypass intended access restrictions and upload files with restricted names via a null byte (%00) in a filename to bin/upload.cgi, as demonstrated using .htaccess to execute arbitrary code.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.20059 · 97.4th percentile
Published
2014-10-16T00:00Z
EPSS history
Timeline
  • 16 OCT 00:00Z
    lib/TWiki/Sandbox.pm in TWiki 6.0.0 and earlier, when running on Windows, allows remote attackers to bypass intended access restrictions and upload files with…
    cvelistv5