Skip to content
OpenAdvisories
Medium · 6.1 CVE-2010-2487 EUVD-2010-0006GHSA-5m2m-27cg-7v4vPYSEC-2010-16

MoinMoin Cross-site Scripting (XSS) vulnerability

Published Aug 4, 2010 · Updated Aug 7, 2024 · Assigned by redhat

Package: moin Ecosystem: PyPI

Description

Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, 1.8.x before 1.8.8, and 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) Page.py, (2) PageEditor.py, (3) PageGraphicalEditor.py, (4) action/CopyPage.py, (5) action/Load.py, (6) action/RenamePage.py, (7) action/backup.py, (8) action/login.py, (9) action/newaccount.py, and (10) action/recoverpass.py.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 5.0 moin 1.7.1-3+lenny5 DSA-2083-1

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI moin <= 1.7.3 — GHSA-5m2m-27cg-7v4v
PyPI moin >= 1.8.0, < 1.8.8 1.8.8 GHSA-5m2m-27cg-7v4v
PyPI moin >= 1.9.0, < 1.9.3 1.9.3 GHSA-5m2m-27cg-7v4v
PyPI moin >= 1.8, < 1.8.8 · >= 1.9, < 1.9.3 1.8.8, 1.9.3 PYSEC-2010-16

Advisories 1

References