PT-2011-2843 · Moinmoin · Moinmoin

Published 2011-02-22 · Updated 2022-05-17 · CVE-2011-1058

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions MoinMoin versions prior to 1.9.3

Description A cross-site scripting (XSS) issue exists in the reStructuredText (rst) parser, allowing remote attackers to inject arbitrary web script or HTML via a javascript: URL in the refuri attribute when docutils is installed or when "format rst" is set.

Recommendations For versions prior to 1.9.3, update to version 1.9.3 or later to resolve the issue. As a temporary workaround, consider disabling the use of the refuri attribute in the reStructuredText parser until a patch is available. Restrict access to the reStructuredText parser to minimize the risk of exploitation. Avoid using the refuri attribute with javascript: URLs in the affected API endpoints until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2011-1058

DSA-2321-1

GHSA-M9J7-XCJ7-42J9

PYSEC-2011-6

Affected Products

Moinmoin

References · 25

• http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055116.html · Vendor Advisory
• http://debian.org/security/2011/dsa-2321 · Vendor Advisory
• http://secunia.com/advisories/43413 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054544.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055124.html · Vendor Advisory
• http://moinmo.in/SecurityFixes · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m9j7-xcj7-42j9 · Vendor Advisory
• http://ubuntu.com/usn/USN-1604-1 · Vendor Advisory
• http://vupen.com/english/advisories/2011/0455 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-1058 · Security Note
• https://osv.dev/vulnerability/PYSEC-2011-6 · Vendor Advisory
• https://github.com/moinwiki/moin · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/moin/PYSEC-2011-6.yaml · Note
• https://web.archive.org/web/20140802163629/http://secunia.com/advisories/43413 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65545 · Note