MoinMoin 1.7.1 allows remote attackers to bypass the textcha protection mechanism by modifying the textcha-question and textcha-answer fields to have empty values.

The remote host is affected by the vulnerability described in GLSA-201210-02 (MoinMoin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MoinMoin. Please review       the CVE identifiers referenced below for details.
  Impact :

    These vulnerabilities in MoinMoin allow remote users to inject arbitrary       web script or HTML, to obtain sensitive information and to bypass the       textcha protection mechanism. There are several other unknown impacts and       attack vectors.
  Workaround :

    There is no known workaround at this time.

It was discovered that MoinMoin did not properly sanitize its input when processing Despam actions, resulting in cross-site scripting (XSS) vulnerabilities. If a privileged wiki user were tricked into performing the Despam action on a page with a crafted title, a remote attacker could exploit this to execute JavaScript code.
(CVE-2010-0828)

It was discovered that the TextCha protection in MoinMoin could be bypassed by submitting a crafted form request. This issue only affected Ubuntu 8.10. (CVE-2010-1238).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jamie Strandboge discovered that moin, a python clone of WikiWiki, does not sufficiently sanitize the page name in 'Despam' action, allowing remote attackers to perform cross-site scripting (XSS) attacks.

In addition, this update fixes a minor issue in the 'textcha' protection, it could be trivially bypassed by blanking the 'textcha-question' and 'textcha-answer' form fields.

ID	Name	Product	Family	Severity
62632	GLSA-201210-02 : MoinMoin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
45475	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : moin vulnerabilities (USN-925-1)	Nessus	Ubuntu Local Security Checks	medium
45396	Debian DSA-2024-1 : moin - insufficient input sanitising	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2010-1238

high

Tenable Plugins

high

medium

medium