Media

Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated use

Publicada: 03.01.2013
Actualizado: 11.10.2026 12:20

Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, as exploited in the wild in July 2012.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Python (PyPI)	moin	< 1.9.6	1.9.6

Referencias

Puntuación CVSS 6.3/10

Vector CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:F
Debilidad (CWE): CWE-434
Plataforma: Python (PyPI)
Paquete: moin
Publicada: 03.01.2013
Actualizado: 11.10.2026 12:20

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-m2c4-jgmm-fvq3 - CC BY 4.0

OSV / GitHub Advisory Database - PYSEC-2013-6 - PyPA Advisory Database; CC BY 4.0

Historial de vulnerabilidades: moin

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (41) en el archivo

Entradas en total: 41
Primera → última: 04.2008 05.2022
Sin corrección: 5
Explotada en ataques: 0

Distribución por gravedad

Alta 11
Media 30

Divulgaciones por año

2017: 1
2018: 1
2019: 0
2020: 2
2021: 0
2022: 14
2023: 0
2024: 0
2025: 0
2026: 0

antes: 23

29.04.2022

MoinMoin Improper Privilege Management

Alta CVE-2004-1463 < 1.2.3 1.2.3
29.04.2022

MoinMoin Improper Access Control

Alta CVE-2004-1462 < 1.2.3 1.2.3
29.04.2022

MoinMoin allows administrative access

Alta CVE-2004-0708 < 1.2.2 1.2.2
10.11.2020

MoinMoin vulnerable to remote code execution via cache action

Alta · 8.8 CVE-2020-25074 < 1.9.11 1.9.11
03.01.2013

Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated use esta entrada

Media · 6.3 CVE-2012-6081 < 1.9.6 1.9.6
29.03.2010

MoinMoin 1.7.x before 1.7.3 and 1.8.x before 1.8.3 checks parent ACLs in certain inappropriate circumstances during processing of hierarchical ACLs, which allows remote attackers to bypass intended ac

Alta · 7.5 CVE-2009-4762 >= 1.7, < 1.7.3, >= 1.8, < 1.8.3 1.7.3, 1.8.3
26.02.2010

MoinMoin before 1.8.7 and 1.9.x before 1.9.2 does not properly sanitize user profiles, which has unspecified impact and attack vectors.

Alta CVE-2010-0669 < 1.8.7, >= 1.9, < 1.9.2 1.8.7, 1.9.2
26.02.2010

The default configuration of cfg.packagepages_actions_excluded in MoinMoin before 1.8.7 does not prevent unsafe package actions, which has unspecified impact and attack vectors.

Alta CVE-2010-0717 < 1.8.7 1.8.7
26.02.2010

MoinMoin 1.9 before 1.9.1 does not perform the expected clearing of the sys.argv array in situations where the GATEWAY_INTERFACE environment variable is set, which allows remote attackers to obtain se

Alta · 7.5 CVE-2010-0667 >= 1.9, < 1.9.1 1.9.1
03.04.2009

MoinMoin 1.6.2 and 1.7 does not properly enforce ACL checks when acl_hierarchic is set to True, which might allow remote attackers to bypass intended access restrictions, a different vulnerability tha

Alta · 7.5 CVE-2008-6603 < 1.6.3, >= 1.7, < 1.7.1 1.6.3, 1.7.1
30.03.2009

MoinMoin Denial of Service vulnerability via password_checker function

Alta · 7.5 CVE-2008-6549 < 1.6.1 1.6.1
25.04.2008

The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage users, which allows remote attackers to gain privileges.

Alta · 7.5 CVE-2008-1937 < 1.6.3, >= 1.7, < 1.7.1 1.6.3, 1.7.1

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación