CVE-2012-6081: Malicious File Upload
Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, as exploited in the wild in July 2012.
Other sources
Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, as exploited in the wild in July 2012.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/mointo a version that resolves this vulnerability.Fixed in 1.9.6 - Upgrade
Upgrade
MoinMointo a version that resolves this vulnerability.Fixed in 1.9.6
Event History
Frequently Asked Questions
What is the severity of CVE-2012-6081?
CVE-2012-6081 is considered a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2012-6081?
To fix CVE-2012-6081, upgrade to MoinMoin version 1.9.6 or later.
What are the affected versions for CVE-2012-6081?
CVE-2012-6081 affects MoinMoin versions earlier than 1.9.6 including versions 0.1 through 1.9.5.
Can CVE-2012-6081 be exploited by unauthenticated users?
No, CVE-2012-6081 requires authenticated users with write permissions to exploit the vulnerability.
What type of vulnerability is CVE-2012-6081?
CVE-2012-6081 is an unrestricted file upload vulnerability allowing execution of arbitrary code.