Login Request a demo
Unscored severity · published Sep 10, 2012
CVE-2012-4404
security/__init__.py in MoinMoin 1.9 through 1.9.4 does not properly handle group names that contain virtual group names such as "All," "Known," or "Trusted," which allows remote…
–
CVSS
2.1%
EPSS
No
On KEV
Description
security/__init__.py in MoinMoin 1.9 through 1.9.4 does not properly handle group names that contain virtual group names such as "All," "Known," or "Trusted," which allows remote authenticated users with virtual group membership to be treated as a member of the group.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
Moinmoin · Moinmo
1.9.0; 1.9.1; 1.9.2; 1.9.3; 1.9.4 · source: NVD
Affected product
MO
Moinmoin
Moinmo
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-4404
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-4404
hg.moinmo.in
http://hg.moinmo.in/moin/1.9/rev/7b9f39289e16
Vendor Advisory
http://moinmo.in/SecurityFixes
Vendor Advisory
http://secunia.com/advisories/50474
Vendor Advisory
http://secunia.com/advisories/50496
secunia.com
http://secunia.com/advisories/50885
www.debian.org
http://www.debian.org/security/2012/dsa-2538
More from Moinmoin
9.8
CVE-2020-25074
The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request
6.1
CVE-2017-5934
Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject arbitrary web script or HTML via…
6.1
CVE-2016-9119
Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.8 allows remote attackers to inject arbitrary web script or HTML via unspecified…
6.1
CVE-2016-7148
MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation" approach, related to a "Cross Site Scripting (XSS)" issue affecting…
6.1
CVE-2016-7146
MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation or crafted URL" approach, related to a "Cross Site Scripting (XSS)"…