Description
Vignette StoryServer 4 and 5, and Vignette V/5 and V/6, with the SSI EXEC feature enabled, allows remote attackers to execute arbitrary code via a text variable to a Vignette Application that is later displayed.
References
- 7685 vdb-entry
- 20030526 S21SEC-016 - Vignette SSI Injection mailing-list
- vignette-ssi-command-execution(12077) vdb-entry
- http://www.s21sec.com/es/avisos/s21sec-016-en.txt