CVE-2008-6548 MoinMoin improper access control on the included page for the rst parser
MediumCVSS 5.0
EPSS 1.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The rst parser (parser/text_rst.py) in MoinMoin 1.6.1 does not check the ACL of an included page, which allows attackers to read unauthorized include files via unknown vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi moin(PyPI) | < 1.6.2 | 1.6.2 |
| pypi moin(PyPI) | All versions | No fix listed |
| pypi moin(PyPI) | = 1.8.4 | No fix listed |
| pypi moin(PyPI) | = 1.8.5 | No fix listed |
| pypi moin(PyPI) | = 1.8.6 | No fix listed |
| pypi moin(PyPI) | = 1.8.7 | No fix listed |
| pypi moin(PyPI) | = 1.9.0 | No fix listed |
| pypi moin(PyPI) | = 1.9.1 | No fix listed |
| pypi moin(PyPI) | = 1.9.10 | No fix listed |
| pypi moin(PyPI) | = 1.9.11 | No fix listed |
| pypi moin(PyPI) | = 1.9.2 | No fix listed |
| pypi moin(PyPI) | = 1.9.3 | No fix listed |
| pypi moin(PyPI) | = 1.9.4 | No fix listed |
| pypi moin(PyPI) | = 1.9.5 | No fix listed |
| pypi moin(PyPI) | = 1.9.6 | No fix listed |
| pypi moin(PyPI) | = 1.9.7 | No fix listed |
| pypi moin(PyPI) | = 1.9.8 | No fix listed |
| pypi moin(PyPI) | = 1.9.9 | No fix listed |
| pypi moin(PyPI) | = 2.0.0a1 | No fix listed |
| pypi moin(PyPI) | = 2.0.0b1 | No fix listed |
| pypi moin(PyPI) | = 2.0.0b2 | No fix listed |
| pypi moin(PyPI) | = 2.0.0b3 | No fix listed |
| pypi moin(PyPI) | = 2.0.0b4 | No fix listed |
| pypi moin(PyPI) | = 2.0.0b5 | No fix listed |
| moinmoin | = 1.6.1 | No fix listed |
Show 1 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/moin(Debian:10) | < 1.6.2-1 | 1.6.2-1 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com product
- github.com
- web.archive.org
- web.archive.org
- hg.moinmo.in broken-link vendor-advisory
- moinmo.in release-notes vendor-advisory
- 48877 broken-link vdb-entry
- github.com vendor-advisory