CVE-2006-6690 (GCVE-0-2006-6690)
Vulnerability from cvelistv5
Published
2006-12-21 21:00
Modified
2024-08-07 20:33
Severity ?
CWE
  • n/a
Summary
rtehtmlarea/pi1/class.tx_rtehtmlarea_pi1.php in Typo3 4.0.0 through 4.0.3, 3.7 and 3.8 with the rtehtmlarea extension, and 4.1 beta allows remote authenticated users to execute arbitrary commands via shell metacharacters in the userUid parameter to rtehtmlarea/htmlarea/plugins/SpellChecker/spell-check-logic.php, and possibly another vector.
References
cve@mitre.org http://lists.netfielders.de/pipermail/typo3-announce/2006/000045.html Vendor Advisory
cve@mitre.org http://lists.netfielders.de/pipermail/typo3-announce/2006/000046.html Vendor Advisory
cve@mitre.org http://secunia.com/advisories/23446 Patch, Vendor Advisory
cve@mitre.org http://secunia.com/advisories/23466 Patch, Vendor Advisory
cve@mitre.org http://securityreason.com/securityalert/2056
cve@mitre.org http://securitytracker.com/id?1017428 Exploit, Patch
cve@mitre.org http://typo3.org/news-single-view/?tx_newsimporter_pi1%5BshowItem%5D=0&cHash=e4a40a11a9
cve@mitre.org http://www.sec-consult.com/272.html Exploit
cve@mitre.org http://www.securityfocus.com/archive/1/454944/100/0/threaded
cve@mitre.org http://www.securityfocus.com/bid/21680 Exploit, Patch
cve@mitre.org http://www.vupen.com/english/advisories/2006/5094
af854a3a-2127-422b-91ae-364da2661108 http://lists.netfielders.de/pipermail/typo3-announce/2006/000045.html Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 http://lists.netfielders.de/pipermail/typo3-announce/2006/000046.html Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 http://secunia.com/advisories/23446 Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 http://secunia.com/advisories/23466 Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 http://securityreason.com/securityalert/2056
af854a3a-2127-422b-91ae-364da2661108 http://securitytracker.com/id?1017428 Exploit, Patch
af854a3a-2127-422b-91ae-364da2661108 http://typo3.org/news-single-view/?tx_newsimporter_pi1%5BshowItem%5D=0&cHash=e4a40a11a9
af854a3a-2127-422b-91ae-364da2661108 http://www.sec-consult.com/272.html Exploit
af854a3a-2127-422b-91ae-364da2661108 http://www.securityfocus.com/archive/1/454944/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108 http://www.securityfocus.com/bid/21680 Exploit, Patch
af854a3a-2127-422b-91ae-364da2661108 http://www.vupen.com/english/advisories/2006/5094
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T20:33:59.962Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20061220 SEC Consult SA-20061220-0 :: Typo3 Command Execution Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/454944/100/0/threaded"
          },
          {
            "name": "23466",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23466"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.sec-consult.com/272.html"
          },
          {
            "name": "[TYPO3-announce] 20061219 Pre-announcement for important security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.netfielders.de/pipermail/typo3-announce/2006/000045.html"
          },
          {
            "name": "1017428",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1017428"
          },
          {
            "name": "2056",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/2056"
          },
          {
            "name": "[TYPO3-announce] 20061220 TYPO3 Security Bulletin TYPO3-20061220-1: Remote Command Execution in TYPO3",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.netfielders.de/pipermail/typo3-announce/2006/000046.html"
          },
          {
            "name": "23446",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23446"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://typo3.org/news-single-view/?tx_newsimporter_pi1%5BshowItem%5D=0\u0026cHash=e4a40a11a9"
          },
          {
            "name": "ADV-2006-5094",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/5094"
          },
          {
            "name": "21680",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/21680"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-12-20T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "rtehtmlarea/pi1/class.tx_rtehtmlarea_pi1.php in Typo3 4.0.0 through 4.0.3, 3.7 and 3.8 with the rtehtmlarea extension, and 4.1 beta allows remote authenticated users to execute arbitrary commands via shell metacharacters in the userUid parameter to rtehtmlarea/htmlarea/plugins/SpellChecker/spell-check-logic.php, and possibly another vector."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-17T20:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20061220 SEC Consult SA-20061220-0 :: Typo3 Command Execution Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/454944/100/0/threaded"
        },
        {
          "name": "23466",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23466"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.sec-consult.com/272.html"
        },
        {
          "name": "[TYPO3-announce] 20061219 Pre-announcement for important security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.netfielders.de/pipermail/typo3-announce/2006/000045.html"
        },
        {
          "name": "1017428",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1017428"
        },
        {
          "name": "2056",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/2056"
        },
        {
          "name": "[TYPO3-announce] 20061220 TYPO3 Security Bulletin TYPO3-20061220-1: Remote Command Execution in TYPO3",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.netfielders.de/pipermail/typo3-announce/2006/000046.html"
        },
        {
          "name": "23446",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23446"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://typo3.org/news-single-view/?tx_newsimporter_pi1%5BshowItem%5D=0\u0026cHash=e4a40a11a9"
        },
        {
          "name": "ADV-2006-5094",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2006/5094"
        },
        {
          "name": "21680",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/21680"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-6690",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "rtehtmlarea/pi1/class.tx_rtehtmlarea_pi1.php in Typo3 4.0.0 through 4.0.3, 3.7 and 3.8 with the rtehtmlarea extension, and 4.1 beta allows remote authenticated users to execute arbitrary commands via shell metacharacters in the userUid parameter to rtehtmlarea/htmlarea/plugins/SpellChecker/spell-check-logic.php, and possibly another vector."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20061220 SEC Consult SA-20061220-0 :: Typo3 Command Execution Vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/454944/100/0/threaded"
            },
            {
              "name": "23466",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23466"
            },
            {
              "name": "http://www.sec-consult.com/272.html",
              "refsource": "MISC",
              "url": "http://www.sec-consult.com/272.html"
            },
            {
              "name": "[TYPO3-announce] 20061219 Pre-announcement for important security update",
              "refsource": "MLIST",
              "url": "http://lists.netfielders.de/pipermail/typo3-announce/2006/000045.html"
            },
            {
              "name": "1017428",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1017428"
            },
            {
              "name": "2056",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/2056"
            },
            {
              "name": "[TYPO3-announce] 20061220 TYPO3 Security Bulletin TYPO3-20061220-1: Remote Command Execution in TYPO3",
              "refsource": "MLIST",
              "url": "http://lists.netfielders.de/pipermail/typo3-announce/2006/000046.html"
            },
            {
              "name": "23446",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23446"
            },
            {
              "name": "http://typo3.org/news-single-view/?tx_newsimporter_pi1%5BshowItem%5D=0\u0026cHash=e4a40a11a9",
              "refsource": "CONFIRM",
              "url": "http://typo3.org/news-single-view/?tx_newsimporter_pi1%5BshowItem%5D=0\u0026cHash=e4a40a11a9"
            },
            {
              "name": "ADV-2006-5094",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2006/5094"
            },
            {
              "name": "21680",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/21680"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2006-6690",
    "datePublished": "2006-12-21T21:00:00",
    "dateReserved": "2006-12-21T00:00:00",
    "dateUpdated": "2024-08-07T20:33:59.962Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2006-6690\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2006-12-21T21:28:00.000\",\"lastModified\":\"2025-04-09T00:30:58.490\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"rtehtmlarea/pi1/class.tx_rtehtmlarea_pi1.php in Typo3 4.0.0 through 4.0.3, 3.7 and 3.8 with the rtehtmlarea extension, and 4.1 beta allows remote authenticated users to execute arbitrary commands via shell metacharacters in the userUid parameter to rtehtmlarea/htmlarea/plugins/SpellChecker/spell-check-logic.php, and possibly another vector.\"},{\"lang\":\"es\",\"value\":\"rtehtmlarea/pi1/class.tx_rtehtmlarea_pi1.php en Typo3 4.0.0 hasta 4.0.3, 3.7 y 3.8 con la extensi\u00f3n rtehtmlarea, y 4.1 beta, permite a atacantes remotos autenticados ejecutar comandos de su elecci\u00f3n mediante metacaracteres del int\u00e9rprete de comandos (shell) a trav\u00e9s del par\u00e1metro userUid en rtehtmlarea/htmlarea/plugins/SpellChecker/spell-check-logic.php,\\r\\ny posiblemente otro vector.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":true,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typo3:typo3:3.7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E53B002D-18FD-4C6A-97C0-AA9C83ABD382\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typo3:typo3:3.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A3390E31-A149-4D83-94D2-63AF63D02A01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typo3:typo3:4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"25EAE65C-1E17-48CD-B48C-E0BC09FB6596\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typo3:typo3:4.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"501A9157-044A-4856-8092-418D7329EED3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typo3:typo3:4.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4EA47174-9BC4-4B74-8618-6A7B0773553B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typo3:typo3:4.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A13146E-EC04-4354-9123-BC7CB292C66A\"}]}]}],\"references\":[{\"url\":\"http://lists.netfielders.de/pipermail/typo3-announce/2006/000045.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://lists.netfielders.de/pipermail/typo3-announce/2006/000046.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/23446\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/23466\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://securityreason.com/securityalert/2056\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://securitytracker.com/id?1017428\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"http://typo3.org/news-single-view/?tx_newsimporter_pi1%5BshowItem%5D=0\u0026cHash=e4a40a11a9\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.sec-consult.com/272.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\"]},{\"url\":\"http://www.securityfocus.com/archive/1/454944/100/0/threaded\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/21680\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"http://www.vupen.com/english/advisories/2006/5094\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.netfielders.de/pipermail/typo3-announce/2006/000045.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://lists.netfielders.de/pipermail/typo3-announce/2006/000046.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/23446\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/23466\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://securityreason.com/securityalert/2056\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://securitytracker.com/id?1017428\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"http://typo3.org/news-single-view/?tx_newsimporter_pi1%5BshowItem%5D=0\u0026cHash=e4a40a11a9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.sec-consult.com/272.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\"]},{\"url\":\"http://www.securityfocus.com/archive/1/454944/100/0/threaded\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/21680\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"http://www.vupen.com/english/advisories/2006/5094\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}],\"evaluatorSolution\":\"his vulnerability is addressed in the following product release:\\r\\nTypo3, Typo3, 4.0.4\"}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.