CVE-2006-6168

tiki-register.php in TikiWiki before 1.9.7 allows remote attackers to trigger "notification-spam" via certain vectors such as a comma-separated list of addresses in the email field, related to lack of "a minimal check on email."

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://tikiwiki.cvs.sourceforge.net/tikiwiki/tiki/changelog.txt?r1=1.157.2.50&r2=1.157.2.51
http://tikiwiki.cvs.sourceforge.net/tikiwiki/tiki/tiki-register.php?r1=1.68&r2=1.69
http://www.vupen.com/english/advisories/2006/4709

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:tiki:tikiwiki_cms\/groupware::::::::
	cpe:2.3:a:tiki:tikiwiki_cms\/groupware:1.6.1:::::::*
	cpe:2.3:a:tiki:tikiwiki_cms\/groupware:1.9.0:::::::*
	cpe:2.3:a:tiki:tikiwiki_cms\/groupware:1.9.0:rc1::::::
	cpe:2.3:a:tiki:tikiwiki_cms\/groupware:1.9.0:rc2::::::
	cpe:2.3:a:tiki:tikiwiki_cms\/groupware:1.9.0:rc3::::::
	cpe:2.3:a:tiki:tikiwiki_cms\/groupware:1.9.1:::::::*
	cpe:2.3:a:tiki:tikiwiki_cms\/groupware:1.9.2:::::::*
	cpe:2.3:a:tiki:tikiwiki_cms\/groupware:1.9.3:::::::*
	cpe:2.3:a:tiki:tikiwiki_cms\/groupware:1.9.4:::::::*
	cpe:2.3:a:tiki:tikiwiki_cms\/groupware:1.9.5:::::::*

History

No history.

Information

Published : 2006-11-29 02:28

Updated : 2024-02-28 11:01

NVD link : CVE-2006-6168

Mitre link : CVE-2006-6168

CVE.ORG link : CVE-2006-6168

JSON object : View

Products Affected

tiki

tikiwiki_cms\/groupware

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2006-6168", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2006-11-29T02:28:00.000", "references": [{"url": "http://tikiwiki.cvs.sourceforge.net/tikiwiki/tiki/changelog.txt?r1=1.157.2.50&r2=1.157.2.51", "source": "cve@mitre.org"}, {"url": "http://tikiwiki.cvs.sourceforge.net/tikiwiki/tiki/tiki-register.php?r1=1.68&r2=1.69", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2006/4709", "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "tiki-register.php in TikiWiki before 1.9.7 allows remote attackers to trigger \"notification-spam\" via certain vectors such as a comma-separated list of addresses in the email field, related to lack of \"a minimal check on email.\""}, {"lang": "es", "value": "tiki-register.php en TikiWiki anterior a 1.9.7 permite a atacantes remotos disparar \"notificaci\u00f3n de spam\" mediante vectores no especificados como una lista de direcciones separadas por coma en el campo email, relacionado con la falta de \"un m\u00ednimo chequeo en email\"."}], "lastModified": "2012-10-24T04:00:00.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tiki:tikiwiki_cms\\/groupware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "255A9708-AA35-458B-8521-735D2AF7A637", "versionEndIncluding": "1.9.6"}, {"criteria": "cpe:2.3:a:tiki:tikiwiki_cms\\/groupware:1.6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "04CA9500-8F56-40DC-A6C4-F9964EFCD4F8"}, {"criteria": "cpe:2.3:a:tiki:tikiwiki_cms\\/groupware:1.9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B13501C0-3322-4D0C-8F7F-12535C76CB69"}, {"criteria": "cpe:2.3:a:tiki:tikiwiki_cms\\/groupware:1.9.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6FB63DA4-E9B5-4BDF-A4E5-54F4EE4E94AA"}, {"criteria": "cpe:2.3:a:tiki:tikiwiki_cms\\/groupware:1.9.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ADE04A29-E90B-41E1-A8B4-462B54C079B4"}, {"criteria": "cpe:2.3:a:tiki:tikiwiki_cms\\/groupware:1.9.0:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2540703B-63B8-41F4-A17A-0274A7DE7E63"}, {"criteria": "cpe:2.3:a:tiki:tikiwiki_cms\\/groupware:1.9.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1489E8DC-11E7-49A3-84FF-909954147D01"}, {"criteria": "cpe:2.3:a:tiki:tikiwiki_cms\\/groupware:1.9.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "035EEFAB-B46C-407F-BF8C-B33756D4EEC3"}, {"criteria": "cpe:2.3:a:tiki:tikiwiki_cms\\/groupware:1.9.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "127349FA-B76D-402A-B688-F2F44024FA11"}, {"criteria": "cpe:2.3:a:tiki:tikiwiki_cms\\/groupware:1.9.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "175D43FD-450F-443E-831B-B8091BE7054F"}, {"criteria": "cpe:2.3:a:tiki:tikiwiki_cms\\/groupware:1.9.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2F437662-CD55-477B-9FEE-0CC4E6CB908D"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}