The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage users, which allows remote attackers to gain privileges.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers
    list, does not properly manage users, which allows remote attackers to gain privileges. (CVE-2008-1937)

MoinMoin team reports :

A check in the userform processing was not working as expected and could be abused for ACL and superuser privilege escalation.

The remote host is affected by the vulnerability described in GLSA-200805-09 (MoinMoin: Privilege escalation)

    It has been reported that the user form processing in the file     userform.py does not properly manage users when using Access Control     Lists or a non-empty superusers list.
  Impact :

    A remote attacker could exploit this vulnerability to gain superuser     privileges on the application.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
432565	SCA: security update for moin (GHSA-rqxp-6926-hphr)	Tenable Cloud Security	SCA Checks	high
432565	SCA: security update for moin (GHSA-rqxp-6926-hphr)	Tenable Self-Hosted Container Security	SCA Checks	high
33188	FreeBSD : moinmoin -- superuser privilege escalation (c4ba95b2-39ce-11dd-98c9-00163e000016)	Nessus	FreeBSD Local Security Checks	medium
32300	GLSA-200805-09 : MoinMoin: Privilege escalation	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2008-1937

high

Tenable Plugins

high

high

medium

medium