Main
Vulnerability Database
Exploits
ID:1728 - Exploit for Arbitrary file upload in MoinMoin - CVE-2012-6081
ID:1728 - Exploit for Arbitrary file upload in MoinMoin - CVE-2012-6081
Published: March 18, 2020
Vulnerability identifier: #VU4216
Vulnerability risk: Critical
CVE-ID: CVE-2012-6081
CWE-ID: CWE-434
Exploitation vector: Remote access
Vulnerable software:
MoinMoin
MoinMoin
Link to public exploit:
Vulnerability description
The vulnerability allows a remote authenticated attacker to compromise system.
The weakness exists due to insufficient validation of the filename extension when uploading files twikidraw (action/twikidraw.py) and anywikidraw (action/anywikidraw.py) actions. A remote authenticated attacker with write permissions can upload and execute arbitrary file with executable extension.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Note: the vulnerability was being actively exploited.
The weakness exists due to insufficient validation of the filename extension when uploading files twikidraw (action/twikidraw.py) and anywikidraw (action/anywikidraw.py) actions. A remote authenticated attacker with write permissions can upload and execute arbitrary file with executable extension.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Note: the vulnerability was being actively exploited.
Remediation
Update to version 1.9.6 or later.