PT-2011-2843 · Moinmoin · Moinmoin
Publicado
2011-02-22
·
Atualizado
2022-05-17
·
CVE-2011-1058
CVSS v4.0
5.1
Média
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
Name of the Vulnerable Software and Affected Versions
MoinMoin versions prior to 1.9.3
Description
A cross-site scripting (XSS) issue exists in the reStructuredText (rst) parser, allowing remote attackers to inject arbitrary web script or HTML via a javascript: URL in the
refuri attribute when docutils is installed or when "format rst" is set.Recommendations
For versions prior to 1.9.3, update to version 1.9.3 or later to resolve the issue. As a temporary workaround, consider disabling the use of the
refuri attribute in the reStructuredText parser until a patch is available. Restrict access to the reStructuredText parser to minimize the risk of exploitation. Avoid using the refuri attribute with javascript: URLs in the affected API endpoints until the issue is resolved.Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Moinmoin