GHSA-jj23-fj2v-m872

MoinMoin Improper Access Control vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2009-4762

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	moin	>= 1.7.0, < 1.7.3	1.7.3
PyPI	moin	>= 1.8.0, < 1.8.3	1.8.3

Details

As written in the advisory (Markdown source, shown as plain text).

MoinMoin 1.7.x before 1.7.3 and 1.8.x before 1.8.3 checks parent ACLs in certain inappropriate circumstances during processing of hierarchical ACLs, which allows remote attackers to bypass intended access restrictions by requesting an item, a different vulnerability than CVE-2008-6603.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2009-4762 advisory
https://github.com/moinwiki/moin package
https://github.com/pypa/advisory-database/tree/main/vulns/moin/PYSEC-2010-13.yaml web
https://web.archive.org/web/20140805132556/http://secunia.com/advisories/39887 web
https://web.archive.org/web/20200228153929/http://www.securityfocus.com/bid/35277 web
http://hg.moinmo.in/moin/1.7/rev/897cdbe9e8f2 web
http://hg.moinmo.in/moin/1.8/rev/897cdbe9e8f2 web
http://moinmo.in/SecurityFixes web
http://ubuntu.com/usn/usn-941-1 web
http://www.debian.org/security/2010/dsa-2014 web