Lucene search

K
githubGitHub Advisory DatabaseGHSA-6766-R2RX-MFW9
HistoryMay 01, 2022 - 11:33 p.m.

MoinMoin Directory traversal vulnerability

2022-05-0123:33:03
CWE-22
GitHub Advisory Database
github.com
5
moinmoin
directory traversal
remote attackers
arbitrary files
cookie
userform action
php code execution
quicklinks parameter
security issue
software update

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

8

Confidence

Low

EPSS

0.063

Percentile

93.7%

Directory traversal vulnerability in MoinMoin 1.5.8 and earlier allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the MOIN_ID user ID in a cookie for a userform action. NOTE: this issue can be leveraged for PHP code execution via the quicklinks parameter. The issue has been fixed on e69a16b6e630.

Affected configurations

Vulners
Node
moinRange≤1.5.8

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

8

Confidence

Low

EPSS

0.063

Percentile

93.7%