GitHub Advisoryadvisory · PyPI

GHSA-5m2m-27cg-7v4v MoinMoin Cross-site Scripting (XSS) vulnerability

MEDIUM Published 2022-05-17 Modified 2024-09-26 Official page ↗
Aliases
CVE-2010-2487
Ecosystem
PyPI
Packages
moin
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-05-01

Affected packages

• PyPI moin: <= 1.7.3 (no fix yet) • PyPI moin: >= 1.8.0, < 1.8.8 → fixed in 1.8.8 • PyPI moin: >= 1.9.0, < 1.9.3 → fixed in 1.9.3

Description

Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, 1.8.x before 1.8.8, and 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) `Page.py`, (2) `PageEditor.py`, (3) `PageGraphicalEditor.py`, (4) `action/CopyPage.py`, (5) `action/Load.py`, (6) `action/RenamePage.py`, (7) `action/backup.py`, (8) `action/login.py`, (9) `action/newaccount.py`, and (10) `action/recoverpass.py`.

Related

Alias · CVE (1)

  • CVE-2010-2487 Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, 1.8.x before 1.8.8, and 1.9.x before 1.9.3 allow remote… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References