PT-2010-2554 · Moinmoin · Moinmoin

Jamie Strandboge + 1 · Published 2010-04-05 · Updated 2022-05-02 · CVE-2010-0828

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions MoinMoin versions 1.8.7 through 1.9.2

Description The issue allows remote authenticated users to inject arbitrary web script or HTML by creating a page with a crafted URI, which is a result of a cross-site scripting (XSS) vulnerability in the Despam action module, specifically in the action/Despam.py file.

Recommendations For versions 1.8.7 and 1.9.2, consider restricting access to the Despam action module until a patch is available. As a temporary workaround, avoid using the Despam action module in MoinMoin until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2010-0828

DSA-2024-1

GHSA-FC72-V54C-X9JG

PYSEC-2010-28

Affected Products

Moinmoin

References · 36

• 🔥 http://hg.moinmo.in/moin/1.9/rev/6e603e5411ca · Exploit
• 🔥 https://bugs.launchpad.net/ubuntu/+source/moin/+bug/538022 · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=578801 · Exploit
• https://debian.org/security/2010/dsa-2024 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038574.html · Vendor Advisory
• http://debian.org/security/2010/dsa-2024 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038490.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-0828 · Vendor Advisory
• https://ubuntu.com/usn/USN-925-1 · Vendor Advisory
• http://vupen.com/english/advisories/2010/0767 · Vendor Advisory
• http://secunia.com/advisories/39190 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0828 · Security Note
• http://ubuntu.com/usn/USN-925-1 · Vendor Advisory
• http://secunia.com/advisories/39188 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038706.html · Vendor Advisory