Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.0

TWiki lets attackers read pages after failed login

CVE-2006-6071 · published 19 years ago
Summary

When TWiki 4.0.5 or earlier runs on Apache 1.3 with ApacheLogin, a failed login can be bypassed using a specially crafted redirect. This lets anyone view wiki content without proper authentication. Upgrade TWiki to a newer version or change the Apache configuration to avoid the vulnerable redirect.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
twiki twiki <= 4.0.5
cpe:2.3:a:twiki:twiki:*:*:*:*:*:*:*:*
Original advisory text
TWiki 4.0.5 and earlier, when running under Apache 1.3 using ApacheLogin with sessions and "ErrorDocument 401" redirects to a valid wiki topic, does not properly handle failed login attempts, which...
TWiki 4.0.5 and earlier, when running under Apache 1.3 using ApacheLogin with sessions and "ErrorDocument 401" redirects to a valid wiki topic, does not properly handle failed login attempts, which allows remote attackers to read arbitrary content by cancelling out of a failed authentication with a valid username and invalid password.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.0 Critical
Exploitation
2% chance of attack within 30 days
Timeline
Published2 Dec 2006
Updated30 Oct 2026
First seen29 Sep 2026
Sources
CVE-2006-6071 · NVD
Track software like this
Free during beta