PT-2012-5378 · Moinmoin · Moinmoin

Raphael Geissert · Publicado 2012-09-10 · Atualizado 2022-05-17 · CVE-2012-4404

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MoinMoin versions 1.9 through 1.9.4

Description The issue arises from improper handling of group names that contain virtual group names, such as "All," "Known," or "Trusted," in the security/ init .py module. This allows remote authenticated users with virtual group membership to be treated as a member of the group.

Recommendations For MoinMoin versions 1.9 through 1.9.4, consider restricting access to the security/ init .py module until a patch is available. As a temporary workaround, avoid using virtual group names such as "All," "Known," or "Trusted" in group names to minimize the risk of exploitation.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-264

CWE-284

Identificadores relacionados

CVE-2012-4404

DSA-2538-1

GHSA-G4MX-RM5Q-VH24

PYSEC-2012-10

Produtos afetados

Moinmoin

Referências · 19

• https://github.com/moinwiki/moin/commit/b7791166cb3613d07c6e8eea966b4f763b2de660 · Nota
• https://github.com/moinwiki/moin · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/moin/PYSEC-2012-10.yaml · Nota
• https://web.archive.org/web/20151016233452/http://secunia.com/advisories/50885 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-4404 · Nota de Segurança
• http://openwall.com/lists/oss-security/2012/09/04/4 · Nota
• https://web.archive.org/web/20151017041755/http://secunia.com/advisories/50496 · Nota
• http://openwall.com/lists/oss-security/2012/09/05/2 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4404 · Nota
• http://secunia.com/advisories/50496 · Aviso do Fabricante
• http://moinmo.in/SecurityFixes · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2012-10 · Aviso do Fabricante
• https://web.archive.org/web/20151017041746/http://secunia.com/advisories/50474 · Nota
• http://secunia.com/advisories/50474 · Aviso do Fabricante
• http://debian.org/security/2012/dsa-2538 · Aviso do Fabricante