Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2006-0446: WeBWorK allows remote attackers to run commands on server

CVE-2006-0446 · published 20 years ago

Summary

The WeBWorK learning platform (versions 2.1.3 and 2.2-pre1) can be tricked by attackers on the network to run any command they choose on the web server. This gives them the same level of access the web server has, which could let them read, change, or delete data. Apply the latest security patches from the vendor as soon as possible and restrict network access to the application.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
webwork	webwork	2.1.3 2.2-pre1 `cpe:2.3:a:webwork:webwork:2.1.3:::::::*`

Original advisory text

Unspecified vulnerability in WeBWorK 2.1.3 and 2.2-pre1 allows remote privileged attackers to execute arbitrary commands as the web server via unknown attack vectors.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Exploitation

3% chance of attack within 30 days

Timeline

Published27 Jan 2006

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2006-0446 · NVD

Track software like this

Free during beta