oss-sec mailing list archives

CVE request: MoinMoin Wiki (remote code execution vulnerability)


From: Tilmann Haak <tilmann () larpwiki de>
Date: Sat, 29 Dec 2012 15:11:21 +0100

Hi all,

there is a remote code execution vulnerability in MoinMoin wiki,
versions 1.9.x up to (and including) 1.9.5. The method save in class
AnyWikiDraw (action/anywikidraw.py) and class TWikiDraw
(action/twikidraw.py) do not filter user supplied input correctly, which
leads to a path traversal vulnerability, which can be exploited to
execute arbitrary code with moin's privileges. An exploit was seen in the wild.

Details can be found at: http://moinmo.in/SecurityFixes

A fix is available at: http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f

Could someone please assign a CVE number?

kind regards,
  Tilmann


Current thread: