GHSA-jj2f-57jg-5rm6 CVE-2008-1099 PYSEC-2026-677
MoinMoin Improper Access Control
Medium
PyPI
- Severity
- Medium
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- 2.02%
- Chance of exploitation in the next 30 days. Higher than 80.97% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
- None yet
- No fixed version published
Description
_macro_Getval in wikimacro.py in MoinMoin 1.5.8 and earlier does not properly enforce ACLs, which allows remote attackers to read protected pages. The issue has been fixed on 4a7de0173734.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| moin | <= 1.5.8 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
References
Advisories
Packages
Other links
- exchange.xforce.ibmcloud.com/vulnerabilities/41038
- usn.ubuntu.com/716-1
- redhat.com/archives/fedora-package-announce/2008-April/msg00510.html
- redhat.com/archives/fedora-package-announce/2008-April/msg00538.html
- hg.moinmo.in/moin/1.5/rev/4a7de0173734
- moinmo.in/SecurityFixes
- secunia.com/advisories/29262
- secunia.com/advisories/29444
- secunia.com/advisories/30031
- secunia.com/advisories/33755
- debian.org/security/2008/dsa-1514
- gentoo.org/security/en/glsa/glsa-200803-27.xml
- securityfocus.com/bid/28177
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-cx94-3h5x-cc57 MoinMoin Cross-site scripting (XSS) vulnerability in the antispam feature | Medium | Also affects moin |
| GHSA-7hjm-hqgj-xv9f MoinMoin Multiple cross-site scripting (XSS) vulnerabilities | Medium | Also affects moin |
| GHSA-8fj9-pj4p-4vq7 MoinMoin Multiple cross-site scripting (XSS) vulnerabilities | Medium | Also affects moin |
| GHSA-6766-r2rx-mfw9 MoinMoin Directory traversal vulnerability | Medium | Also affects moin |
| GHSA-775g-4482-pm94 MoinMoin Multiple cross-site scripting (XSS) vulnerabilities | Medium | Also affects moin |
| GHSA-53wj-6m7w-j6mj MoinMoin Cross-site scripting (XSS) vulnerability | Medium | Also affects moin |
| GHSA-cmg7-xr2j-4r9v MoinMoin Improper ACL handling for calendars and includes | Medium | Also affects moin |
| GHSA-mxh8-xgq9-w782 MoinMoin Insertion of Sensitive Information into Log File | Medium | Also affects moin |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor