CVE-2012-4404 MoinMoin Improper Access Control
MediumCVSS 6.0
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
security/init.py in MoinMoin 1.9 through 1.9.4 does not properly handle group names that contain virtual group names such as "All," "Known," or "Trusted," which allows remote authenticated users with virtual group membership to be treated as a member of the group.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi moin(PyPI) | >= 1.9, < 1.9.5 | 1.9.5 |
| pypi moin(PyPI) | = 1.9.0 | No fix listed |
| pypi moin(PyPI) | = 1.9.1 | No fix listed |
| pypi moin(PyPI) | = 1.9.2 | No fix listed |
| pypi moin(PyPI) | = 1.9.3 | No fix listed |
| pypi moin(PyPI) | = 1.9.4 | No fix listed |
| moinmoin | = 1.9.0 | No fix listed |
| moinmoin | = 1.9.1 | No fix listed |
| moinmoin | = 1.9.2 | No fix listed |
| moinmoin | = 1.9.3 | No fix listed |
| moinmoin | = 1.9.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com product
- github.com
- web.archive.org
- web.archive.org
- web.archive.org
- hg.moinmo.in
- moinmo.in vendor-advisory
- DSA-2538 vendor-advisory
- [oss-security] 20120904 CVE request: moinmoin incorrect ACL evaluation for virtual groups mailing-list
- [oss-security] 20120904 Re: CVE request: moinmoin incorrect ACL evaluation for virtual groups mailing-list
- USN-1604-1 vendor-advisory
- 50496 third-party-advisory vendor-advisory
- 50474 third-party-advisory vendor-advisory
- 50885 third-party-advisory vendor-advisory
- github.com vendor-advisory