CVE-2006-6852

{"id": "CVE-2006-6852", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2006-12-31T05:00:00.000", "references": [{"url": "http://jvn.jp/jp/JVN%2331185550/index.html", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/23465", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/21811", "source": "cve@mitre.org"}, {"url": "http://www.tdiary.org/20061210.html", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2006/5201", "source": "cve@mitre.org"}, {"url": "http://jvn.jp/jp/JVN%2331185550/index.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/23465", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/21811", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.tdiary.org/20061210.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.vupen.com/english/advisories/2006/5201", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Eval injection vulnerability in tDiary 2.0.3 and 2.1.4.200 61127 allows remote authenticated users to execute arbitrary Ruby code via unspecified vectors, possibly related to incorrect input validation by (1) conf.rhtml and (2) i.conf.rhtml. NOTE: some of these details are obtained from third party information."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n de secuencias de entrada evaluables en tDiary 2.0.3 y 2.1.4.200 61127 permite a atacantes remotos autenticados ejecutar c\u00f3digo Ruby de su elecci\u00f3n mediante vectores no especificados, posiblemente referidos a validaci\u00f3n de entrada incorrecta en (1) conf.rhtml y (2) i.conf.rhtml. \r\nNOTA: algunos de estos detalles se han obtenido de informaci\u00f3n de terceros."}], "lastModified": "2025-04-09T00:30:58.490", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tdiary:tdiary:2.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "901E2D28-D124-4633-918B-CDB0EA08C8A2"}, {"criteria": "cpe:2.3:a:tdiary:tdiary:2.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A7D4A716-2D1B-47F0-BB24-EC8364CCD5FA"}, {"criteria": "cpe:2.3:a:tdiary:tdiary:2.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FD08310D-FF5A-4CFB-866C-9B7308230783"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}