MoinMoin improper access control on the included page for the rst parser

中危 5.0CVE-2008-6548 · GHSA-jhxw-4hw4-mhh7 · PYSEC-2009-11 · Published 30/03/2009 · updated 16/06/2026

要点

CVE-2008-6548 是影响 moin, moinmoin (moinmo) 的中危 (CVSS 5.0)漏洞。
未来 30 天内被利用的概率（EPSS）：1.0%，高于 62.9% 的漏洞。
修复：升级到 1.6.2 或更高版本。

Package	Affected versions	Patched versions
moin PyPI	`< 1.6.2all versions`	`1.6.2`
moinmoin moinmo	`= 1.6.1`	No fix yet

Description

The rst parser (parser/text_rst.py) in MoinMoin 1.6.1 does not check the ACL of an included page, which allows attackers to read unauthorized include files via unknown vectors.

NVD description

The rst parser (parser/text_rst.py) in MoinMoin 1.6.1 does not check the ACL of an included page, which allows attackers to read unauthorized include files via unknown vectors.

References

nvd.nist.gov/vuln/detail/CVE-2008-6548 · ADVISORY
moinwiki/moin · PACKAGE
pypa/advisory-database · WEB
web.archive.org/web/20080523123729/http://hg.moinmo.in/moin/1.6/raw-file/1.6.2/docs/CHANGES · WEB
web.archive.org/web/20211206185024/http://hg.moinmo.in/moin/1.6/rev/35ff7a9b1546 · WEB
hg.moinmo.in/moin/1.6/rev/35ff7a9b1546 · WEB
moinmo.in/SecurityFixes · WEB
osvdb.org/48877 · Broken Link
GitHub Advisory GHSA-jhxw-4hw4-mhh7 · ADVISORY

moin 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

moin

PyPI

< 1.6.2all versions

1.6.2

moinmoin

moinmo

= 1.6.1

No fix yet

Description

The rst parser (parser/text_rst.py) in MoinMoin 1.6.1 does not check the ACL of an included page, which allows attackers to read unauthorized include files via unknown vectors.

NVD description

The rst parser (parser/text_rst.py) in MoinMoin 1.6.1 does not check the ACL of an included page, which allows attackers to read unauthorized include files via unknown vectors.

moin 的其他漏洞

查看全部 →