PT-2013-1876 · Moinmoin · Moinmoin

Jamie Strandboge + 1 · Published 2013-01-03 · Updated 2022-05-17 · CVE-2012-6080

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MoinMoin versions 1.9.3 through 1.9.5

Description The issue allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a file name, due to a directory traversal vulnerability in the do attachment move function in the AttachFile action (action/AttachFile.py).

Recommendations For MoinMoin versions 1.9.3 through 1.9.5, consider disabling the do attachment move function in the AttachFile action until a patch is available. Restrict access to the AttachFile action to minimize the risk of exploitation. Avoid using file names containing .. (dot dot) in the affected AttachFile action until the issue is resolved.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2012-6080

DSA-2593-1

GHSA-V33Q-2XCJ-4F3M

PYSEC-2013-5

Affected Products

Moinmoin

References · 20

• http://hg.moinmo.in/moin/1.9/rev/3c27131a3c52 · Patch
• http://secunia.com/advisories/51676 · Vendor Advisory
• http://secunia.com/advisories/51663 · Vendor Advisory
• http://debian.org/security/2012/dsa-2593 · Vendor Advisory
• http://ubuntu.com/usn/usn-1680-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-6080 · Security Note
• https://osv.dev/vulnerability/GHSA-v33q-2xcj-4f3m · Vendor Advisory
• http://moinmo.in/SecurityFixes · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2013-5 · Vendor Advisory
• http://secunia.com/advisories/51696 · Vendor Advisory
• https://github.com/moinwiki/moin · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/moin/PYSEC-2013-5.yaml · Note
• http://openwall.com/lists/oss-security/2012/12/30/6 · Note
• https://web.archive.org/web/20151104192815/http://secunia.com/advisories/51676 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6080 · Note