CVE-2012-6081: MoinMoin Multiple unrestricted file upload vulnerabilities

May 17, 2022 (updated September 26, 2024)

Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, as exploited in the wild in July 2012.

References

bugs.launchpad.net/ubuntu/+source/moin/+bug/1094599
github.com/advisories/GHSA-m2c4-jgmm-fvq3
github.com/moinwiki/moin
github.com/pypa/advisory-database/tree/main/vulns/moin/PYSEC-2013-6.yaml
nvd.nist.gov/vuln/detail/CVE-2012-6081
web.archive.org/web/20200228165146/http://www.securityfocus.com/bid/57082

Code Behaviors & Features

Detect and mitigate CVE-2012-6081 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →