PT-2010-2554 · Moinmoin · Moinmoin

Jamie Strandboge + 1 · Publicado 2010-04-05 · Atualizado 2022-05-02 · CVE-2010-0828

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions MoinMoin versions 1.8.7 through 1.9.2

Description The issue allows remote authenticated users to inject arbitrary web script or HTML by creating a page with a crafted URI, which is a result of a cross-site scripting (XSS) vulnerability in the Despam action module, specifically in the action/Despam.py file.

Recommendations For versions 1.8.7 and 1.9.2, consider restricting access to the Despam action module until a patch is available. As a temporary workaround, avoid using the Despam action module in MoinMoin until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2010-0828

DSA-2024-1

GHSA-FC72-V54C-X9JG

PYSEC-2010-28

Produtos afetados

Moinmoin

Referências · 36

• 🔥 http://hg.moinmo.in/moin/1.9/rev/6e603e5411ca · Exploit
• 🔥 https://bugs.launchpad.net/ubuntu/+source/moin/+bug/538022 · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=578801 · Exploit
• https://github.com/moinwiki/moin · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/moin/PYSEC-2010-28.yaml · Nota
• https://web.archive.org/web/20220927220946/http://hg.moinmo.in/moin/1.9/rev/689e2b04bd4d · Nota
• http://vupen.com/english/advisories/2010/0834 · Nota
• https://debian.org/security/2010/dsa-2024 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/57435 · Nota
• https://web.archive.org/web/20151017033557/http://secunia.com/advisories/39190 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038574.html · Aviso do Fabricante
• http://debian.org/security/2010/dsa-2024 · Aviso do Fabricante
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=575995 · Nota
• https://web.archive.org/web/20151017033127/http://secunia.com/advisories/39267 · Nota
• http://securityfocus.com/bid/39110 · Nota