CVE-2008-6548

MEDIUM5.3EPSS 0.23%

MoinMoin improper access control on the included page for the rst parser

發布日:2022/5/17修改日:2024/6/4

也稱為:GHSA-jhxw-4hw4-mhh7PYSEC-2009-11

描述

The rst parser (parser/text_rst.py) in MoinMoin 1.6.1 does not check the ACL of an included page, which allows attackers to read unauthorized include files via unknown vectors.

受影響套件(3)

Debian/moinfrom 0, < 1.6.2-1
PyPI/moinfrom 0, < 1.6.2
PyPI/moinfrom 0

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
osv	CVSS 3.1	MEDIUM5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

參考連結(8)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2008-6548
PATCHhttps://github.com/moinwiki/moin
WEBhttp://hg.moinmo.in/moin/1.6/rev/35ff7a9b1546
WEBhttp://moinmo.in/SecurityFixes
WEBhttp://osvdb.org/48877
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/moin/PYSEC-2009-11.yaml
WEBhttps://web.archive.org/web/20080523123729/http://hg.moinmo.in/moin/1.6/raw-file/1.6.2/docs/CHANGES
WEBhttps://web.archive.org/web/20211206185024/http://hg.moinmo.in/moin/1.6/rev/35ff7a9b1546