This security advisory describes one critical risk vulnerability.
Exploit availability: Yes [Search exploit]Description
The vulnerability allows a remote authenticated attacker to compromise system.
The weakness exists due to insufficient validation of the filename extension when uploading files twikidraw (action/twikidraw.py) and anywikidraw (action/anywikidraw.py) actions. A remote authenticated attacker with write permissions can upload and execute arbitrary file with executable extension.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Note: the vulnerability was being actively exploited.
Update to version 1.9.6 or later.
MoinMoin: 1.9, 1.9.1, 1.9.2, 1.9.3, 1.9.4, 1.9.5CPE
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.