Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to overwrite arbitrary files via unspecified vectors. NOTE: this can be leveraged with CVE-2012-6081 to execute arbitrary code.

The remote host is affected by the vulnerability described in GLSA-201309-14 (MoinMoin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MoinMoin. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to execute arbitrary code with the       privileges of the process, overwrite arbitrary files, or conduct       Cross-Site Scripting (XSS) attacks.
  Workaround :

    There is no known workaround at this time.

The MoinMoin install hosted on the remote web server fails to properly sanitize user-supplied input in the twikidraw (action/twikidraw.py) action.  A remote, unauthenticated attacker could utilize a specially crafted request using directory traversal style characters to upload a file containing arbitrary code to the remote host.  An attacker could then execute the code with the privileges of the user that runs the MoinMoin process.  Successful exploitation requires that the MoinMoin plugin directory has write permission set for the MoinMoin server user. 

Note that the 'anywikidraw' action is reportedly also affected by the directory traversal and code execution vulnerabilities.  The application is also reportedly affected by an additional directory traversal vulnerability in the action/AttachFile.py script (CVE-2012-6080) as well as a cross-site scripting (XSS) vulnerability when creating an rss link (CVE-2012-6082).  Nessus has not, however, tested for these additional issues.

It was discovered that missing input validation in the twikidraw and anywikidraw actions can result in the execution of arbitrary code.
This security issue is being actively exploited.

This update also addresses path traversal in AttachFile.

ID	Name	Product	Family	Severity
70110	GLSA-201309-14 : MoinMoin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
63638	MoinMoin twikidraw.py Traversal File Upload Arbitrary File Overwrite	Nessus	CGI abuses	high
63356	Debian DSA-2593-1 : moin - several vulnerabilities	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2012-6495

medium

Tenable Plugins

medium

high

medium