CVE-2012-6495 MoinMoin Multiple vulnerable to directory traversal

What is CVE-2012-6495?

CVE-2012-6495 is a medium-severity path traversal vulnerability in n/a, published on 3 Jan 2013. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to overwrite arbitrary files via unspecified vectors. NOTE: this can be leveraged with CVE-2012-6081 to execute arbitrary code.

Weakness: CWE-22

Which versions are affected by CVE-2012-6495?

3 open source packages ship an affected version, including moin and Moin. It affects 1 product.

Products include Moinmo Moinmoin.

How do I fix CVE-2012-6495?

Upgrade moin to 1.9.6 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2012-6495 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2012-6495 exists.

Public exploit code: 2 Exploit-DB entries.

Other vulnerabilities in n/a

• CVE-2020-15275 malicious SVG attachment causing stored XSS vulnerability in MoinMoin High 8.7
• CVE-2009-4762 MoinMoin Improper Access Control vulnerability High 7.5
• CVE-2010-0669 MoinMoin improper sanitizes user profiles High 7.5
• CVE-2010-0717 MoinMoin has improper default configuration High 7.5
• CVE-2010-0668 MoinMoin has multiple vulnerabilities related to superuser list, xmlrpc and OpenID configuration Medium 6.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6gx4-29v9-g9q5, PYSEC-2013-7.