PT-2010-2419 · Moinmoin · Moinmoin

Jan Lieskovsky · Published 2010-02-26 · Updated 2022-05-02 · CVE-2010-0667

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MoinMoin versions 1.9 through 1.9.1 (excluding 1.9.1)

Description The issue arises when the GATEWAY INTERFACE environment variable is set, and the sys.argv array is not properly cleared, allowing remote attackers to obtain sensitive information via unspecified vectors.

Recommendations For MoinMoin version 1.9, update to version 1.9.1 to resolve the issue. At the moment, there is no additional information about other mitigation measures.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2010-0667

GHSA-876C-QMCF-CXV6

PYSEC-2010-14

Affected Products

Moinmoin

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2010-0667 · Security Note
• https://osv.dev/vulnerability/GHSA-876c-qmcf-cxv6 · Vendor Advisory
• http://moinmo.in/SecurityFixes · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2010-14 · Vendor Advisory
• http://secunia.com/advisories/38242 · Vendor Advisory
• https://github.com/moinwiki/moin · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/moin/PYSEC-2010-14.yaml · Note
• http://openwall.com/lists/oss-security/2010/02/15/2 · Note
• http://hg.moinmo.in/moin/1.9/raw-file/1.9.1/docs/CHANGES · Note
• http://marc.info/?l=oss-security&m=126676896601156&w=2 · Note
• http://hg.moinmo.in/moin/1.9/rev/9d8e7ce3c3a2 · Note
• http://openwall.com/lists/oss-security/2010/01/21/6 · Note
• http://moinmo.in/MoinMoinChat/Logs/moin-dev/2010-01-18 · Note
• http://hg.moinmo.in/moin/1.9/rev/04afdde50094 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0667 · Note