CVE-2008-6548
CVE-2008-6548 is a medium-severity vulnerability in Moinmo Moinmoin with a CVSS 2.0 base score of 5.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-862.
Key facts
- Severity: Medium (CVSS 2.0 base score 5.0)
- EPSS exploit prediction: 1% (59th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-862
- Affected product: Moinmo Moinmoin
- Published:
- Last modified:
Description
The rst parser (parser/text_rst.py) in MoinMoin 1.6.1 does not check the ACL of an included page, which allows attackers to read unauthorized include files via unknown vectors.
Frequently asked questions
- What is CVE-2008-6548?
- The rst parser (parser/text_rst.py) in MoinMoin 1.6.1 does not check the ACL of an included page, which allows attackers to read unauthorized include files via unknown vectors.
- How severe is CVE-2008-6548?
- CVE-2008-6548 has a CVSS 2.0 base score of 5.0, rated medium severity.
- Is CVE-2008-6548 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (59th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2008-6548?
- CVE-2008-6548 affects Moinmo Moinmoin. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2008-6548?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2008-6548 published?
- CVE-2008-6548 was published on 2009-03-30 and last updated on 2026-06-16.
References
Affected products (1)
- cpe:2.3:a:moinmo:moinmoin:1.6.1:*:*:*:*:*:*:*
More vulnerabilities in Moinmo Moinmoin
- CVE-2020-25074 — Critical (CVSS 9.8): The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP…
- CVE-2020-15275 — High (CVSS 8.7): MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file…
- CVE-2009-4762 — High (CVSS 7.5): MoinMoin 1.7.x before 1.7.3 and 1.8.x before 1.8.3 checks parent ACLs in certain inappropriate circumstances during…
- CVE-2010-0717 — High (CVSS 7.5): The default configuration of cfg.packagepages_actions_excluded in MoinMoin before 1.8.7 does not prevent unsafe package…
- CVE-2010-0669 — High (CVSS 7.5): MoinMoin before 1.8.7 and 1.9.x before 1.9.2 does not properly sanitize user profiles, which has unspecified impact and…
- CVE-2010-0668 — Medium (CVSS 6.8): Unspecified vulnerability in MoinMoin 1.5.x through 1.7.x, 1.8.x before 1.8.7, and 1.9.x before 1.9.2 has unknown…
All CVEs affecting Moinmo Moinmoin →
Other CWE-862 (Missing Authorization) vulnerabilities
- CVE-2026-0092 — Critical (CVSS 10.0): In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could…
- CVE-2026-33712 — Critical (CVSS 10.0): Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the preview chat endpoint (POST…
- CVE-2026-2031 — Critical (CVSS 10.0): An Improper Access Control vulnerability in several internal API endpoints for Google Cloud Application Integration…
- CVE-2026-34976 — Critical (CVSS 10.0): Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing…
- CVE-2025-30416 — Critical (CVSS 10.0): Sensitive data disclosure and manipulation due to missing authorization. The following products are affected: Acronis…
- CVE-2025-45854 — Critical (CVSS 10.0): /server/executeExec of JEHC-BPM 2.0.1 allows attackers to execute arbitrary code via execParams.
Browse all CWE-862 (Missing Authorization) vulnerabilities →