Description
The (1) rdiff and (2) preview scripts in TWiki 4.0 and 4.0.1 ignore access control settings, which allows remote attackers to read restricted areas and access restricted content in TWiki topics.
References
- twiki-restricted-content-access(25444) vdb-entry
- 17268 vdb-entry
- 19410 third-party-advisory
- 1015843 vdb-entry
- ADV-2006-1116 vdb-entry
- http://twiki.org/cgi-bin/view/Codev/SecurityAlertTWiki4RdiffPreviewAccess