CVE-2020-25074: Path Traversal
Impact The cache action in action/cache.py allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.
Patches Users are strongly advised to upgrade to a patched version.
MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.
Workarounds It is not advised to work around this, but to upgrade MoinMoin to a patched version.
That said, a work around via disabling the cache or the AttachFile action might be possible.
Also, it is of course helpful if you give write permissions (which include uploading attachments) only to trusted users.
Credits
This vulnerability was discovered by Michael Chapman.
For more information If you have any questions or comments about this advisory, email me at twaldmann@thinkmo.de.
Other sources
The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-25074?
CVE-2020-25074 has a high severity as it allows directory traversal that could lead to remote code execution.
How do I fix CVE-2020-25074?
To fix CVE-2020-25074, upgrade to MoinMoin Wiki version 1.9.11 or later.
Who is affected by CVE-2020-25074?
CVE-2020-25074 affects users of MoinMoin Wiki versions prior to 1.9.11.
What kind of attack can be executed using CVE-2020-25074?
An attacker can exploit CVE-2020-25074 to perform directory traversal and potentially execute remote code.
Is there a patch available for CVE-2020-25074?
Yes, a patch is available and users are strongly advised to upgrade to the patched version.