Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, 1.8.x before 1.8.8, and 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) Page.py, (2) PageEditor.py, (3) PageGraphicalEditor.py, (4) action/CopyPage.py, (5) action/Load.py, (6) action/RenamePage.py, (7) action/backup.py, (8) action/login.py, (9) action/newaccount.py, and (10) action/recoverpass.py.

The remote host is affected by the vulnerability described in GLSA-201210-02 (MoinMoin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MoinMoin. Please review       the CVE identifiers referenced below for details.
  Impact :

    These vulnerabilities in MoinMoin allow remote users to inject arbitrary       web script or HTML, to obtain sensitive information and to bypass the       textcha protection mechanism. There are several other unknown impacts and       attack vectors.
  Workaround :

    There is no known workaround at this time.

It was discovered that MoinMoin did not properly sanitize its input, resulting in cross-site scripting (XSS) vulnerabilities. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that moin, a python clone of WikiWiki, does not sufficiently sanitize parameters when passing them to the add_msg function. This allows a remote attackers to conduct cross-site scripting (XSS) attacks for example via the template parameter.

The version of MoinMoin running on the remote host is affected by a cross-site scripting vulnerability in the 'template' parameter of the 'PageEditor.py' script. An unauthenticated, remote attacker, exploiting this flaw, could execute arbitrary script code in a user's browser.

ID	Name	Product	Family	Severity
62632	GLSA-201210-02 : MoinMoin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
48758	Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : moin vulnerabilities (USN-977-1)	Nessus	Ubuntu Local Security Checks	medium
48240	Debian DSA-2083-1 : moin - missing input sanitization	Nessus	Debian Local Security Checks	medium
46817	MoinMoin PageEditor.py template Parameter XSS	Nessus	CGI abuses : XSS	medium

Detections

Analytics

CVE-2010-2487

medium

Tenable Plugins

high

medium

medium

medium