MoinMoin 1.7.x before 1.7.3 and 1.8.x before 1.8.3 checks parent ACLs in certain inappropriate circumstances during processing of hierarchical ACLs, which allows remote attackers to bypass intended access restrictions by requesting an item, a different vulnerability than CVE-2008-6603.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - MoinMoin 1.7.x before 1.7.3 and 1.8.x before 1.8.3 checks parent ACLs in certain inappropriate
    circumstances during processing of hierarchical ACLs, which allows remote attackers to bypass intended
    access restrictions by requesting an item, a different vulnerability than CVE-2008-6603. (CVE-2009-4762)

It was discovered that MoinMoin incorrectly handled hierarchical access control lists. Users could bypass intended access controls under certain circumstances.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in moin, a python clone of WikiWiki. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-0668     Multiple security issues in MoinMoin related to     configurations that have a non-empty superuser list, the     xmlrpc action enabled, the SyncPages action enabled, or     OpenID configured.

  - CVE-2010-0669     MoinMoin does not properly sanitize user profiles.

  - CVE-2010-0717     The default configuration of     cfg.packagepages_actions_excluded in MoinMoin does not     prevent unsafe package actions.

In addition, this update fixes an error when processing hierarchical ACLs, which can be exploited to access restricted sub-pages.

ID	Name	Product	Family	Severity
432586	SCA: security update for moin (GHSA-jj23-fj2v-m872)	Tenable Cloud Security	SCA Checks	high
432586	SCA: security update for moin (GHSA-jj23-fj2v-m872)	Tenable Self-Hosted Container Security	SCA Checks	high
46691	Ubuntu 9.04 : moin vulnerability (USN-941-1)	Nessus	Ubuntu Local Security Checks	high
45056	Debian DSA-2014-1 : moin - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2009-4762

high

Tenable Plugins

high

high

high

high