PT-2010-2468 · Moinmoin · Moinmoin

Jan Lieskovsky · Published 2010-02-26 · Updated 2022-05-02 · CVE-2010-0717

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MoinMoin versions prior to 1.8.7

Description The default configuration of cfg.packagepages actions excluded in MoinMoin does not prevent unsafe package actions, which has unspecified impact and attack vectors.

Recommendations For versions prior to 1.8.7, update to version 1.8.7 or later to resolve the issue. As a temporary workaround, consider modifying the cfg.packagepages actions excluded configuration to exclude unsafe package actions until a patch is available.

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2010-0717

DSA-2014-1

GHSA-5JJR-GMQ3-F986

PYSEC-2010-3

Affected Products

Moinmoin

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2010-0717 · Security Note
• https://osv.dev/vulnerability/GHSA-5jjr-gmq3-f986 · Vendor Advisory
• http://debian.org/security/2010/dsa-2014 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2010-3 · Vendor Advisory
• https://github.com/moinwiki/moin · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/moin/PYSEC-2010-3.yaml · Note
• http://openwall.com/lists/oss-security/2010/02/15/2 · Note
• http://vupen.com/english/advisories/2010/0600 · Note
• http://secunia.com/advisories/38903 · Note
• https://web.archive.org/web/20140807024009/http://secunia.com/advisories/38903 · Note
• http://hg.moinmo.in/moin/1.8/raw-file/1.8.7/docs/CHANGES · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/56595 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0717 · Note
• http://moinmo.in/MoinMoinRelease1.8 · Note