GitHub Advisoryadvisory · PyPI

GHSA-6766-r2rx-mfw9 MoinMoin Directory traversal vulnerability

MEDIUM Published 2022-05-01 Modified 2024-05-14 Official page ↗
Aliases
CVE-2008-0782
Ecosystem
PyPI
Packages
moin
Severity
Moderate
Weaknesses
CWE-22
Reviewed
2024-05-14

Affected packages

• PyPI moin: <= 1.5.8 (no fix yet)

Description

Directory traversal vulnerability in MoinMoin 1.5.8 and earlier allows remote attackers to overwrite arbitrary files via a `..` (dot dot) in the MOIN_ID user ID in a cookie for a userform action. NOTE: this issue can be leveraged for PHP code execution via the quicklinks parameter. The issue has been fixed on e69a16b6e630.

Related

Alias · CVE (1)

  • CVE-2008-0782 Directory traversal vulnerability in MoinMoin 1.5.8 and earlier allows remote attackers to overwrite arbitrary files via a .. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References