oss-sec mailing list archives

CVE request: MoinMoin Wiki (path traversal vulnerability)


From: Tilmann Haak <tilmann () larpwiki de>
Date: Sat, 29 Dec 2012 19:29:40 +0100

Hi all,

there is a path traversal issue in MoinMoin wiki (version 1.9.3 -
1.9.5). The vulnerability resides in the AttachFile action (function
_do_attachment_move in action/AttachFile.py). It fails to properly
sanitize file names.

Details can be found at: http://moinmo.in/SecurityFixes

A fix is available at: http://hg.moinmo.in/moin/1.9/rev/3c27131a3c52

Is it possible to get a CVE number for this one?

kind regards,
  Tilmann


Current thread: