Description
MoinMoin 1.7.x before 1.7.3 and 1.8.x before 1.8.3 checks parent ACLs in certain inappropriate circumstances during processing of hierarchical ACLs, which allows remote attackers to bypass intended access restrictions by requesting an item, a different vulnerability than CVE-2008-6603.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | moin | >= 1.7.0, < 1.7.3 | 1.7.3 | GHSA-jj23-fj2v-m872 |
| PyPI | moin | >= 1.8.0, < 1.8.3 | 1.8.3 | GHSA-jj23-fj2v-m872 |
| PyPI | moin | >= 1.7, < 1.7.3 · >= 1.8, < 1.8.3 | 1.7.3, 1.8.3 | PYSEC-2010-13 |
References
- http://hg.moinmo.in/moin/1.7/rev/897cdbe9e8f2
- http://moinmo.in/SecurityFixes
- ADV-2010-1208 vdb-entry
- DSA-2014 vendor-advisory
- 39887 third-party-advisory
- 35277 vdb-entry
- USN-941-1 vendor-advisory
- ADV-2010-0600 vdb-entry
- http://hg.moinmo.in/moin/1.8/rev/897cdbe9e8f2