Cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text_rst.py in MoinMoin before 1.9.3, when docutils is installed or when "format rst" is set, allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in the refuri attribute. NOTE: some of these details are obtained from third party information.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text_rst.py in
    MoinMoin before 1.9.3, when docutils is installed or when "format rst" is set, allows remote attackers to
    inject arbitrary web script or HTML via a javascript: URL in the refuri attribute. NOTE: some of these
    details are obtained from third party information. (CVE-2011-1058)

The remote host is affected by the vulnerability described in GLSA-201210-02 (MoinMoin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MoinMoin. Please review       the CVE identifiers referenced below for details.
  Impact :

    These vulnerabilities in MoinMoin allow remote users to inject arbitrary       web script or HTML, to obtain sensitive information and to bypass the       textcha protection mechanism. There are several other unknown impacts and       attack vectors.
  Workaround :

    There is no known workaround at this time.

It was discovered that MoinMoin did not properly sanitize certain input, resulting in a cross-site scripting (XSS) vulnerability. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2011-1058)

It was discovered that MoinMoin incorrectly handled group names that contain virtual group names such as 'All', 'Known' or 'Trusted'. This could result in a remote user having incorrect permissions.
(CVE-2012-4404).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

MITRE CVE team reports :

Cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text_rst.py in MoinMoin before 1.9.4, when docutils is installed or when 'format rst' is set, allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in the refuri attribute.

A cross-site scripting vulnerability was discovered in the reStructuredText parser of Moin, a Python clone of WikiWiki.

- Thu Feb 24 2011 Ville-Pekka Vainio <vpivaini AT     cs.helsinki.fi> - 1.9.3-4

    - Fixes CVE-2011-1058 (rhbz#679523)

    - Tue Feb 8 2011 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1.9.3-3

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild

    - Fri Jul 23 2010 Ville-Pekka Vainio <vpivaini AT       cs.helsinki.fi> 1.9.3-2

    - Rebuilt for       https://fedoraproject.org/wiki/Features/Python_2.7/Mas       sRebuild

    - Mon Jun 28 2010 Ville-Pekka Vainio <vpivaini AT       cs.helsinki.fi> 1.9.3-1

    - Fixes multiple XSS vulnerabilities (rhbz#601399)

    -       http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANG       ES

    - Drop integrated security patch

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Thu Feb 24 2011 Ville-Pekka Vainio <vpivaini AT     cs.helsinki.fi> - 1.9.3-4

    - Fixes CVE-2011-1058 (rhbz#679523)

    - Tue Feb 8 2011 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1.9.3-3

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Bug #679523 - CVE-2011-1058 MoinMoin: XSS in the rst     parser

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
434435	SCA: security update for moin (GHSA-m9j7-xcj7-42j9)	Tenable Cloud Security	SCA Checks	Local	medium
434435	SCA: security update for moin (GHSA-m9j7-xcj7-42j9)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
62632	GLSA-201210-02 : MoinMoin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
62511	Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : moin vulnerabilities (USN-1604-1)	Nessus	Ubuntu Local Security Checks	Local	medium
61780	FreeBSD : moinmoin -- XSS via RST parser (4a8a98ab-f745-11e1-8bd8-0022156e8794)	Nessus	FreeBSD Local Security Checks	Local	low
56443	Debian DSA-2321-1 : moin - XSS	Nessus	Debian Local Security Checks	Local	low
52560	Fedora 13 : moin-1.9.3-4.fc13 (2011-2157)	Nessus	Fedora Local Security Checks	Local	low
52559	Fedora 14 : moin-1.9.3-4.fc14 (2011-2156)	Nessus	Fedora Local Security Checks	Local	low
52521	Fedora 15 : moin-1.9.3-4.fc15 (2011-2219)	Nessus	Fedora Local Security Checks	Local	low

Detections

Analytics

CVE-2011-1058

medium

Tenable Plugins

medium

medium

high

medium

low

low

low

low

low