GitHub Advisoryadvisory · PyPI

GHSA-8fj9-pj4p-4vq7 MoinMoin Multiple cross-site scripting (XSS) vulnerabilities

MEDIUM Published 2022-05-01 Modified 2024-05-14 Official page ↗
Aliases
CVE-2008-1098
Ecosystem
PyPI
Packages
moin
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2024-05-14

Affected packages

• PyPI moin: <= 1.5.8 (no fix yet)

Description

Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.5.8 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) certain input processed by `formatter/text_gedit.py` (aka the gui editor formatter); (2) a page name, which triggers an injection in PageEditor.py when the page is successfully deleted by a victim in a DeletePage action; or (3) the destination page name for a RenamePage action, which triggers an injection in PageEditor.py when a victim's rename attempt fails because of a duplicate name. NOTE: the AttachFile XSS issue is already covered by CVE-2008-0781, and the login XSS issue is already covered by CVE-2008-0780. The issue has been fixed on d0152eeb4499 and 4ede07e792dd.

Related

Alias · CVE (1)

  • CVE-2008-1098 Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.5.8 and earlier allow remote attackers to inject arbitrary web script or… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References