Back to KEVs

CVE-2012-6081

Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in...

Basic Information

CVE State
PUBLISHED
Reserved Date
December 06, 2012
Published Date
January 03, 2013
Last Updated
August 06, 2024
Vendor
MoinMoin
Product
MoinMoin
Description
Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, as exploited in the wild in July 2012.
Tags
metasploit_scanner

CVSS Scores

CVSS v2.0

6.0

Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P

Exploit Status

Exploited in the Wild
Yes (2013-01-03 01:00:00 UTC) Source

References

http://moinmo.in/MoinMoinRelease1.9 http://moinmo.in/SecurityFixes http://secunia.com/advisories/51663 http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f http://www.debian.org/security/2012/dsa-2593 https://bugs.launchpad.net/ubuntu/+source/moin/+bug/1094599 http://www.securityfocus.com/bid/57082 http://www.openwall.com/lists/oss-security/2012/12/29/6 http://secunia.com/advisories/51676 http://www.openwall.com/lists/oss-security/2012/12/30/4 http://secunia.com/advisories/51696 http://www.exploit-db.com/exploits/25304 http://ubuntu.com/usn/usn-1680-1

Known Exploited Vulnerability Information

Source Added Date
CVE 2013-01-03 01:00:00 UTC

Scanner Integrations

Scanner URL Date Detected
Metasploit https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/moinmoin_twikidraw.rb 2025-04-29 11:01:28 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

moinmoin_twikidraw

Type: metasploit • Created: Unknown

Metasploit module for CVE-2012-6081

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel

  • Detected by Metasploit