CVE-2008-6603: High severity MoinMoin vulnerability
MoinMoin 1.6.2 and 1.7 does not properly enforce ACL checks when aclhierarchic is set to True, which might allow remote attackers to bypass intended access restrictions, a different vulnerability than CVE-2008-1937.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/mointo a version that resolves this vulnerability.Fixed in 1.7.1 - Upgrade
Upgrade
pip/mointo a version that resolves this vulnerability.Fixed in 1.6.3 - Configuration
Set acl_hierarchic to False in the MoinMoin configuration to avoid the ACL-check bypass condition that occurs when acl_hierarchic is True.
pip/moin acl_hierarchic = False
Event History
Frequently Asked Questions
What is the severity of CVE-2008-6603?
CVE-2008-6603 is considered a high severity vulnerability due to its potential to allow unauthorized access to restricted resources.
How do I fix CVE-2008-6603?
To fix CVE-2008-6603, upgrade MoinMoin to version 1.7.1 or above if you are using 1.7, or to version 1.6.3 if you are using 1.6.
Which versions of MoinMoin are affected by CVE-2008-6603?
The affected versions of MoinMoin include 1.6.2, 1.7.0, and 1.7.
What does CVE-2008-6603 affect?
CVE-2008-6603 affects the Access Control List (ACL) functionality in MoinMoin when 'acl_hierarchic' is set to True.
Can CVE-2008-6603 be exploited remotely?
Yes, CVE-2008-6603 can be exploited remotely, allowing attackers to bypass intended access restrictions.