PT-2013-1876 · Moinmoin · Moinmoin

Jamie Strandboge + 1 · Publicado 2013-01-03 · Atualizado 2022-05-17 · CVE-2012-6080

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MoinMoin versions 1.9.3 through 1.9.5

Description The issue allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a file name, due to a directory traversal vulnerability in the do attachment move function in the AttachFile action (action/AttachFile.py).

Recommendations For MoinMoin versions 1.9.3 through 1.9.5, consider disabling the do attachment move function in the AttachFile action until a patch is available. Restrict access to the AttachFile action to minimize the risk of exploitation. Avoid using file names containing .. (dot dot) in the affected AttachFile action until the issue is resolved.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2012-6080

DSA-2593-1

GHSA-V33Q-2XCJ-4F3M

PYSEC-2013-5

Produtos afetados

Moinmoin

Referências · 20

• https://github.com/moinwiki/moin · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/moin/PYSEC-2013-5.yaml · Nota
• http://hg.moinmo.in/moin/1.9/rev/3c27131a3c52 · Correção
• http://secunia.com/advisories/51676 · Aviso do Fabricante
• http://secunia.com/advisories/51663 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/12/30/6 · Nota
• http://debian.org/security/2012/dsa-2593 · Aviso do Fabricante
• http://ubuntu.com/usn/usn-1680-1 · Aviso do Fabricante
• https://web.archive.org/web/20151104192815/http://secunia.com/advisories/51676 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6080 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-6080 · Nota de Segurança
• https://web.archive.org/web/20130513231719/http://secunia.com/advisories/51663 · Nota
• https://osv.dev/vulnerability/GHSA-v33q-2xcj-4f3m · Aviso do Fabricante
• https://web.archive.org/web/20200228145410/http://securityfocus.com/bid/57076 · Nota
• https://web.archive.org/web/20151017045319/http://secunia.com/advisories/51696 · Nota