GitHub Advisoryadvisory · PyPI

GHSA-4q96-6xhq-ff43 malicious SVG attachment causing stored XSS vulnerability

MEDIUM Published 2020-11-11 Modified 2024-10-07 Official page ↗
Aliases
CVE-2020-15275
Ecosystem
PyPI
Packages
moin
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-79
Reviewed
2020-11-11

Affected packages

• PyPI moin: < 1.9.11 → fixed in 1.9.11

Description

Impact An attacker with `write` permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki. Patches Users are strongly advised to upgrade to a patched version. MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes. Workarounds It is not advised to work around this, but to upgrade MoinMoin to a patched version. That said, a work around via a Content Security Policy in the web server might be possible. Also, it is of course helpful if you give `write` permissions (which include uploading attachments) only to trusted users. For more information If you have any questions or comments about this advisory, email me at [email protected]. Credits This vulnerability was discovered by: Catarina Leite from the Checkmarx SCA AppSec team

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References