PT-2012-5378 · Moinmoin · Moinmoin

Raphael Geissert · Published 2012-09-10 · Updated 2022-05-17 · CVE-2012-4404

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MoinMoin versions 1.9 through 1.9.4

Description The issue arises from improper handling of group names that contain virtual group names, such as "All," "Known," or "Trusted," in the security/ init .py module. This allows remote authenticated users with virtual group membership to be treated as a member of the group.

Recommendations For MoinMoin versions 1.9 through 1.9.4, consider restricting access to the security/ init .py module until a patch is available. As a temporary workaround, avoid using virtual group names such as "All," "Known," or "Trusted" in group names to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-264

CWE-284

Related Identifiers

CVE-2012-4404

DSA-2538-1

GHSA-G4MX-RM5Q-VH24

PYSEC-2012-10

Affected Products

Moinmoin

References · 19

• https://nvd.nist.gov/vuln/detail/CVE-2012-4404 · Security Note
• http://secunia.com/advisories/50496 · Vendor Advisory
• http://moinmo.in/SecurityFixes · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2012-10 · Vendor Advisory
• http://secunia.com/advisories/50474 · Vendor Advisory
• http://debian.org/security/2012/dsa-2538 · Vendor Advisory
• http://ubuntu.com/usn/USN-1604-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g4mx-rm5q-vh24 · Vendor Advisory
• https://github.com/moinwiki/moin/commit/b7791166cb3613d07c6e8eea966b4f763b2de660 · Note
• https://github.com/moinwiki/moin · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/moin/PYSEC-2012-10.yaml · Note
• https://web.archive.org/web/20151016233452/http://secunia.com/advisories/50885 · Note
• http://openwall.com/lists/oss-security/2012/09/04/4 · Note
• https://web.archive.org/web/20151017041755/http://secunia.com/advisories/50496 · Note
• http://openwall.com/lists/oss-security/2012/09/05/2 · Note