Ben Wheeler has reported a vulnerability in TWiki, which can be exploited by malicious people to compromise a vulnerable system.

Input passed to the "TYPEOF" parameter in twiki/bin/configure is not properly sanitised before being evaluated. This can be exploited by to execute arbitrary shell commands by sending a specially crafted HTTP POST request to the script.

Successful exploitation requires incorrectly configured access (no authentication) for the "twiki/bin/configure" script.

The vulnerability has been reported in 4.0.0 through 4.0.4.

Solution
Apply hotfix:
Further details available in Customer Area

Provided and/or discovered by
Ben Wheeler

Original Advisory
http://twiki.org/cgi-bin/view/Codev/SecurityAlertCmdExecWithConfigure

Deep Links
Links available in Customer Area