CVE-2008-0782 MoinMoin Directory traversal vulnerability

What is CVE-2008-0782?

CVE-2008-0782 is a medium-severity path traversal vulnerability in n/a, published on 14 Feb 2008. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Directory traversal vulnerability in MoinMoin 1.5.8 and earlier allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the MOIN_ID user ID in a cookie for a userform action. NOTE: this issue can be leveraged for PHP code execution via the quicklinks parameter.

Weakness: CWE-22

Which versions are affected by CVE-2008-0782?

3 open source packages ship an affected version, including moin. It affects 1 product.

Products include Moinmoin Moinmoin.

How do I fix CVE-2008-0782?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2008-0782 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2008-0782 exists.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in n/a

• CVE-2004-1463 MoinMoin Improper Privilege Management Critical 10.0
• CVE-2004-1462 MoinMoin Improper Access Control High 7.5
• CVE-2004-0708 MoinMoin allows administrative access High 7.5
• CVE-2008-1937 MoinMoin vulnerable to privilege escalation Medium 6.8
• CVE-2007-2423 Cross-site scripting in n/a Medium 5.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6766-r2rx-mfw9, PYSEC-2026-668.