Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title New moin packages fix cross-site scripting
Informations
Name DSA-2083 First vendor Publication 2010-08-02
Vendor Debian Last vendor Modification 2010-08-02
Severity (Vendor) N/A Revision 1

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Cvss Base Score 4.3 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

It was discovered that moin, a python clone of WikiWiki, does not sufficiently sanitize parameters when passing them to the add_msg function. This allows a remote attackers to conduct cross-site scripting (XSS) attacks for example via the template parameter.

For the stable distribution (lenny), this problem has been fixed in version 1.7.1-3+lenny5.

For the testing distribution (squeeze), this problem will be fixed soon.

For the unstable distribution (sid), this problem has been fixed in version 1.9.3-1.

Original Source

Url : http://www.debian.org/security/2010/dsa-2083

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:11879
 
Oval ID: oval:org.mitre.oval:def:11879
Title: DSA-2083-1 moin -- missing input sanitisation
Description: It was discovered that moin, a python clone of WikiWiki, does not sufficiently sanitise parameters when passing them to the add_msg function. This allows a remote attackers to conduct cross-site scripting attacks for example via the template parameter. For the stable distribution, this problem has been fixed in version 1.7.1-3+lenny5. For the testing distribution, this problem will be fixed soon. For the unstable distribution, this problem has been fixed in version 1.9.3-1.
Family: unix Class: patch
Reference(s): DSA-2083-1
CVE-2010-2487
 Version: 5
Platform(s): Debian GNU/Linux 5.0
 Product(s): moin
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13311
 
Oval ID: oval:org.mitre.oval:def:13311
Title: USN-977-1 -- moin vulnerabilities
Description: It was discovered that MoinMoin did not properly sanitize its input, resulting in cross-site scripting vulnerabilities. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain.
Family: unix Class: patch
Reference(s): USN-977-1
CVE-2010-2487
CVE-2010-2969
CVE-2010-2970
 Version: 5
Platform(s): Ubuntu 8.04
Ubuntu 10.04
Ubuntu 9.10
Ubuntu 6.06
Ubuntu 9.04
 Product(s): moin
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 75

OpenVAS Exploits

Date Description
2012-10-22 Name : Gentoo Security Advisory GLSA 201210-02 (MoinMoin)
File : nvt/glsa_201210_02.nasl
2010-08-30 Name : Ubuntu Update for moin vulnerabilities USN-977-1
File : nvt/gb_ubuntu_USN_977_1.nasl
2010-08-21 Name : Debian Security Advisory DSA 2083-1 (moin)
File : nvt/deb_2083_1.nasl
2010-07-05 Name : MoinMoin 'PageEditor.py' Cross-Site Scripting Vulnerability
File : nvt/gb_moinmoin_40549.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
66908 MoinMoin action/recoverpass.py Unspecified Parameter XSS
66907 MoinMoin action/newaccount.py Unspecified Parameter XSS
66906 MoinMoin action/login.py Unspecified Parameter XSS
66905 MoinMoin action/backup.py Unspecified Parameter XSS
66904 MoinMoin action/RenamePage.py Unspecified Parameter XSS
66903 MoinMoin action/Load.py Unspecified Parameter XSS
66902 MoinMoin action/CopyPage.py Unspecified Parameter XSS
66901 MoinMoin PageGraphicalEditor.py Unspecified Parameter XSS
66900 MoinMoin Page.py Unspecified Parameter XSS
66899 MoinMoin action/userprofile.py Unspecified Parameter XSS
66898 MoinMoin action/chart.py Unspecified Parameter XSS
66897 MoinMoin action/LikePages.py Unspecified Parameter XSS
66896 MoinMoin action/language_setup.py Unspecified Parameter XSS
66895 MoinMoin action/anywikidraw.py Unspecified Parameter XSS
66894 MoinMoin action/SlideShow.py Unspecified Parameter XSS
65065 MoinMoin PageEditor.py template Parameter XSS

MoinMoin contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'template' parameter upon submission to the 'PageEditor.py' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

Nessus® Vulnerability Scanner

Date Description
2012-10-19 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201210-02.nasl - Type : ACT_GATHER_INFO
2010-08-26 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-977-1.nasl - Type : ACT_GATHER_INFO
2010-08-04 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2083.nasl - Type : ACT_GATHER_INFO
2010-06-07 Name : A wiki application on the remote web server has a cross-site scripting vulner...
File : moinmoin_pageeditor_xss.nasl - Type : ACT_ATTACK

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:29:34
  • Multiple Updates