—

PYSEC-2009-11

Details

The rst parser (parser/text_rst.py) in MoinMoin 1.6.1 does not check the ACL of an included page, which allows attackers to read unauthorized include files via unknown vectors.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/moin

Introduced in: 0

No fixed version published yet for moin (pip). Pin to a known-safe version or switch to an alternative.

References

http://hg.moinmo.in/moin/1.6/rev/35ff7a9b1546[WEB]
http://hg.moinmo.in/moin/1.6/rev/35ff7a9b1546[ADVISORY]
http://osvdb.org/48877[WEB]
http://moinmo.in/SecurityFixes[WEB]
http://moinmo.in/SecurityFixes[ADVISORY]
https://github.com/advisories/GHSA-jhxw-4hw4-mhh7[ADVISORY]