Description
MoinMoin 1.2.1 and earlier allows remote attackers to gain privileges by creating a user with the same name as an existing group that has higher privileges.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | moin | < 1.2.2 | 1.2.2 | GHSA-7jrp-r6jx-32cw |
References
- GLSA-200407-09 vendor-advisory
- http://sourceforge.net/tracker/index.php?func=detail&aid=948103&group_id=8482&atid=108482
- moinmoin-gain-admin-access(16465) vdb-entry
- 11807 third-party-advisory
- 10568 vdb-entry
- 6704 vdb-entry