oss-sec mailing list archives
CVE request: MoinMoin Wiki (remote code execution vulnerability)
From: Tilmann Haak <tilmann () larpwiki de>
Date: Sat, 29 Dec 2012 15:11:21 +0100
Hi all, there is a remote code execution vulnerability in MoinMoin wiki, versions 1.9.x up to (and including) 1.9.5. The method save in class AnyWikiDraw (action/anywikidraw.py) and class TWikiDraw (action/twikidraw.py) do not filter user supplied input correctly, which leads to a path traversal vulnerability, which can be exploited toexecute arbitrary code with moin's privileges. An exploit was seen in the wild.
Details can be found at: http://moinmo.in/SecurityFixes A fix is available at: http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f Could someone please assign a CVE number? kind regards, Tilmann
Current thread:
- CVE request: MoinMoin Wiki (remote code execution vulnerability) Tilmann Haak (Dec 29)
- Re: CVE request: MoinMoin Wiki (remote code execution vulnerability) Kurt Seifried (Dec 29)