CVE-2020-25074: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The cache action in action/cache.py in MoinMo allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.
References
- moinmo.in/SecurityFixes
- github.com/advisories/GHSA-52q8-877j-gghq
- github.com/moinwiki/moin-1.9/commit/6b96a9060069302996b5af47fd4a388fc80172b7
- github.com/moinwiki/moin-1.9/security/advisories/GHSA-52q8-877j-gghq
- lists.debian.org/debian-lts-announce/2020/11/msg00020.html
- nvd.nist.gov/vuln/detail/CVE-2020-25074
- pypi.org/project/moin/
- www.debian.org/security/2020/dsa-4787
Detect and mitigate CVE-2020-25074 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →