Vulnerability Details : CVE-2008-0782
Directory traversal vulnerability in MoinMoin 1.5.8 and earlier allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the MOIN_ID user ID in a cookie for a userform action. NOTE: this issue can be leveraged for PHP code execution via the quicklinks parameter.
Vulnerability category: Directory traversal
Products affected by CVE-2008-0782
- cpe:2.3:a:moinmoin:moinmoin:1.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:moinmoin:moinmoin:1.1:*:*:*:*:*:*:*
- cpe:2.3:a:moinmoin:moinmoin:1.2:*:*:*:*:*:*:*
- cpe:2.3:a:moinmoin:moinmoin:0.3:*:*:*:*:*:*:*
- cpe:2.3:a:moinmoin:moinmoin:0.7:*:*:*:*:*:*:*
- cpe:2.3:a:moinmoin:moinmoin:1.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:moinmoin:moinmoin:0.10:*:*:*:*:*:*:*
- cpe:2.3:a:moinmoin:moinmoin:0.11:*:*:*:*:*:*:*
- cpe:2.3:a:moinmoin:moinmoin:0.2:*:*:*:*:*:*:*
- cpe:2.3:a:moinmoin:moinmoin:0.8:*:*:*:*:*:*:*
- cpe:2.3:a:moinmoin:moinmoin:0.9:*:*:*:*:*:*:*
- cpe:2.3:a:moinmoin:moinmoin:0.1:*:*:*:*:*:*:*
- cpe:2.3:a:moinmoin:moinmoin:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:moinmoin:moinmoin:1.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:moinmoin:moinmoin:1.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:moinmoin:moinmoin:1.5.5a:*:*:*:*:*:*:*
- cpe:2.3:a:moinmoin:moinmoin:1.5.3_rc2:*:*:*:*:*:*:*
- cpe:2.3:a:moinmoin:moinmoin:1.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:moinmoin:moinmoin:1.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:moinmoin:moinmoin:1.5.5:*:*:*:*:*:*:*
- cpe:2.3:a:moinmoin:moinmoin:1.5.5_rc1:*:*:*:*:*:*:*
- cpe:2.3:a:moinmoin:moinmoin:1.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:moinmoin:moinmoin:1.5.3_rc1:*:*:*:*:*:*:*
- cpe:2.3:a:moinmoin:moinmoin:1.5.7:*:*:*:*:*:*:*
- cpe:2.3:a:moinmoin:moinmoin:1.5.8:*:*:*:*:*:*:*
- cpe:2.3:a:moinmoin:moinmoin:1.5.6:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2008-0782
5.65%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 93 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2008-0782
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST |
CWE ids for CVE-2008-0782
-
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.Assigned by: nvd@nist.gov (Primary)
References for CVE-2008-0782
-
http://www.attrition.org/pipermail/vim/2008-January/001890.html
[VIM] MoinMoin 1.5.x MOIND_ID cookie Bug Remote Exploit
-
http://hg.moinmo.in/moin/1.5/rev/e69a16b6e630
404 Not Found
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/39837
MoinMoin cookie directory traversal CVE-2008-0782 Vulnerability Report
-
http://www.debian.org/security/2008/dsa-1514
[SECURITY] [DSA 1514-1] New moin packages fix several vulnerabilities
-
http://www.vupen.com/english/advisories/2008/0569/references
Webmail: access your OVH emails on ovhcloud.com | OVHcloud UK
-
http://www.securityfocus.com/bid/27404
-
https://www.exploit-db.com/exploits/4957
MoinMoin 1.5.x - 'MOIND_ID' Cookie Login Bypass - PHP webapps Exploit
-
http://www.gentoo.org/security/en/glsa/glsa-200803-27.xml
MoinMoin: Multiple vulnerabilities (GLSA 200803-27) — Gentoo security
-
https://usn.ubuntu.com/716-1/
404: Page not found | Ubuntu
Jump to