FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2008-0782

This CVE name corresponds to:

Entered	Topic
2008-02-25	moinmoin -- multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2008-0782 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2008-0782
Phase	Assigned(20080214)

Description

Directory traversal vulnerability in MoinMoin 1.5.8 and earlier allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the MOIN_ID user ID in a cookie for a userform action. NOTE: this issue can be leveraged for PHP code execution via the quicklinks parameter.

References

Source	Reference
MILW0RM	4957
CONFIRM	http://hg.moinmo.in/moin/1.5/rev/e69a16b6e630
DEBIAN	DSA-1514
GENTOO	GLSA-200803-27
UBUNTU	USN-716-1
VIM	20080124 MoinMoin 1.5.x MOIND_ID cookie Bug Remote Exploit
BID	27404
VUPEN	ADV-2008-0569
SECUNIA	29010
SECUNIA	29262
SECUNIA	29444
SECUNIA	33755
XF	moinmoin-readme-file-overwrite(39837)