CVE-2020-25074: MoinMoin vulnerable to remote code execution via cache action
(updated )
The cache action in action/cache.py allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.
References
- github.com/advisories/GHSA-52q8-877j-gghq
- github.com/moinwiki/moin
- github.com/moinwiki/moin-1.9/commit/6b96a9060069302996b5af47fd4a388fc80172b7
- github.com/moinwiki/moin-1.9/security/advisories/GHSA-52q8-877j-gghq
- github.com/pypa/advisory-database/tree/main/vulns/moin/PYSEC-2020-67.yaml
- lists.debian.org/debian-lts-announce/2020/11/msg00020.html
- nvd.nist.gov/vuln/detail/CVE-2020-25074
- pypi.org/project/moin
- www.debian.org/security/2020/dsa-4787
Detect and mitigate CVE-2020-25074 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →