GitHub Advisoryadvisory · PyPI

GHSA-g4mx-rm5q-vh24 MoinMoin Improper Access Control

MEDIUM Published 2022-05-17 Modified 2024-09-26 Official page ↗
Aliases
CVE-2012-4404
Ecosystem
PyPI
Packages
moin
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-284
Reviewed
2024-05-01

Affected packages

• PyPI moin: >= 1.9, < 1.9.5 → fixed in 1.9.5

Description

`security/__init__.py` in MoinMoin 1.9 through 1.9.4 does not properly handle group names that contain virtual group names such as "All," "Known," or "Trusted," which allows remote authenticated users with virtual group membership to be treated as a member of the group.

Related

Alias · CVE (1)

  • CVE-2012-4404 security/__init__.py in MoinMoin 1.9 through 1.9.4 does not properly handle group names that contain virtual group names such as "All,"… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References