The search function in TWiki 20030201 allows remote attackers to execute arbitrary commands via shell metacharacters in a search string.

Exploit prediction (EPSS)

61.67% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.

Exploits and detections

• Metasploit exploit/unix/webapp/twiki_search TWiki Search Function Arbitrary Command Execution · metasploit exploit, excellent rank · 2004-10-01
• EDB-642 TWiki 20030201 - 'search.pm' Remote Command Execution · webapps · 2004-11-20
• EDB-16894 TWiki - Search Function Arbitrary Command Execution (Metasploit) · webapps · 2010-07-03

CVSS scores

References

• distro.conectiva.com.br /atualizacoes/?id=a&anuncio=000918 · vendor-advisory, x_refsource_CONECTIVA, x_transferred
• securityfocus.com /bid/11674 · vdb-entry, x_refsource_BID, x_transferred
• exchange.xforce.ibmcloud.com /vulnerabilities/18062 · vdb-entry, x_refsource_XF, x_transferred
• twiki.org /cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithSearch · x_refsource_CONFIRM, x_transferred
• archives.neohapsis.com /archives/bugtraq/2004-11/0201.html · mailing-list, x_refsource_FULLDISC, x_transferred
• security.gentoo.org /glsa/glsa-200411-33.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
• marc.info /?l=bugtraq&m=110037207516456&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
• ciac.org /ciac/bulletins/p-039.shtml · third-party-advisory, government-resource, x_refsource_CIAC, x_transferred

Sources

• CVE List: CVE-2004-1037
• NVD: CVE-2004-1037

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.