CVE-2008-0782

Publication date 14 February 2008

Last updated 24 July 2024

Directory traversal vulnerability in MoinMoin 1.5.8 and earlier allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the MOIN_ID user ID in a cookie for a userform action. NOTE: this issue can be leveraged for PHP code execution via the quicklinks parameter.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
moin	8.10 intrepid	Not affected
	8.04 LTS hardy	Fixed 1.5.8-5.1ubuntu2.2
	7.10 gutsy	Fixed 1.5.7-3ubuntu2.1
	7.04 feisty	Ignored end of life, was needed
	6.10 edgy	Ignored end of life, was needed
	6.06 LTS dapper	Fixed 1.5.2-1ubuntu2.4

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
moin	Vendor: http://www.debian.org/security/2008/dsa-1514 Other: http://hg.moinmo.in/moin/1.5/rev/e69a16b6e630

References

Related Ubuntu Security Notices (USN)

USN-716-1
MoinMoin vulnerabilities
30 January 2009

Other references

https://www.cve.org/CVERecord?id=CVE-2008-0782