PT-2009-3980 · Moinmoin · Moinmoin

Published 2009-04-29 · Updated 2022-05-02 · CVE-2009-1482

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions: MoinMoin versions 1.8.2 and earlier

Description: The issue allows remote attackers to inject arbitrary web script or HTML via multiple vectors, including an AttachFile sub-action in the error msg function or multiple vectors related to package file errors in the upload form function.

Recommendations: For MoinMoin versions 1.8.2 and earlier, consider disabling the action/AttachFile.py module until a patch is available. Restrict access to the upload form function to minimize the risk of exploitation. Avoid using the error msg function in the AttachFile sub-action until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-1482

DSA-1791-1

GHSA-4PFG-2FRF-F67V

PYSEC-2009-6

Affected Products

Moinmoin

References · 21

• 🔥 http://hg.moinmo.in/moin/1.8/rev/5f51246a4df1 · Exploit
• http://debian.org/security/2009/dsa-1791 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1482 · Security Note
• http://vupen.com/english/advisories/2009/1119 · Vendor Advisory
• http://ubuntu.com/usn/USN-774-1 · Vendor Advisory
• http://moinmo.in/SecurityFixes · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2009-6 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4pfg-2frf-f67v · Vendor Advisory
• http://secunia.com/advisories/34821 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-1482 · Vendor Advisory
• https://github.com/moinwiki/moin · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/moin/PYSEC-2009-6.yaml · Note
• http://secunia.com/advisories/34945 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1482 · Note
• https://web.archive.org/web/20200301062001/http://securityfocus.com/bid/34631 · Note