#VU32754 Permissions, Privileges, and Access Controls in MoinMoin - CVE-2012-4404 

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU32754

#VU32754 Permissions, Privileges, and Access Controls in MoinMoin - CVE-2012-4404

Published: September 11, 2012 / Updated: July 28, 2020


Vulnerability identifier: #VU32754
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2012-4404
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
MoinMoin
Software vendor:
MoinMoin

Description

The vulnerability allows a remote #AU# to read and manipulate data.

security/__init__.py in MoinMoin 1.9 through 1.9.4 does not properly handle group names that contain virtual group names such as "All," "Known," or "Trusted," which allows remote authenticated users with virtual group membership to be treated as a member of the group.


Remediation

Install update from vendor's website.

External links