Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | MoinMoin: Multiple vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | GLSA-201210-02 | First vendor Publication | 2012-10-18 |
| Vendor | Gentoo | Last vendor Modification | 2012-10-18 |
| Severity (Vendor) | Normal | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Synopsis Multiple vulnerabilities have been found in MoinMoin, the worst of which allowing for injection of arbitrary web script or HTML. Background Description Impact Workaround Resolution References Availability http://security.gentoo.org/glsa/glsa-201210-02.xml |
Original Source
| Url : http://security.gentoo.org/glsa/glsa-201210-02.xml |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 71 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
| 14 % | CWE-264 | Permissions, Privileges, and Access Controls |
| 14 % | CWE-16 | Configuration |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:11879 | |||
| Oval ID: | oval:org.mitre.oval:def:11879 | ||
| Title: | DSA-2083-1 moin -- missing input sanitisation | ||
| Description: | It was discovered that moin, a python clone of WikiWiki, does not sufficiently sanitise parameters when passing them to the add_msg function. This allows a remote attackers to conduct cross-site scripting attacks for example via the template parameter. For the stable distribution, this problem has been fixed in version 1.7.1-3+lenny5. For the testing distribution, this problem will be fixed soon. For the unstable distribution, this problem has been fixed in version 1.9.3-1. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2083-1 CVE-2010-2487 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 | Product(s): | moin |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:13275 | |||
| Oval ID: | oval:org.mitre.oval:def:13275 | ||
| Title: | USN-925-1 -- moin vulnerabilities | ||
| Description: | It was discovered that MoinMoin did not properly sanitize its input when processing Despam actions, resulting in cross-site scripting vulnerabilities. If a privileged wiki user were tricked into performing the Despam action on a page with a crafted title, a remote attacker could exploit this to execute JavaScript code. It was discovered that the TextCha protection in MoinMoin could be bypassed by submitting a crafted form request. This issue only affected Ubuntu 8.10 | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-925-1 CVE-2010-0828 CVE-2010-1238 | Version: | 5 |
| Platform(s): | Ubuntu 8.04 Ubuntu 8.10 Ubuntu 9.10 Ubuntu 6.06 Ubuntu 9.04 | Product(s): | moin |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:13311 | |||
| Oval ID: | oval:org.mitre.oval:def:13311 | ||
| Title: | USN-977-1 -- moin vulnerabilities | ||
| Description: | It was discovered that MoinMoin did not properly sanitize its input, resulting in cross-site scripting vulnerabilities. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-977-1 CVE-2010-2487 CVE-2010-2969 CVE-2010-2970 | Version: | 5 |
| Platform(s): | Ubuntu 8.04 Ubuntu 10.04 Ubuntu 9.10 Ubuntu 6.06 Ubuntu 9.04 | Product(s): | moin |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:13549 | |||
| Oval ID: | oval:org.mitre.oval:def:13549 | ||
| Title: | USN-911-1 -- moin vulnerabilities | ||
| Description: | It was discovered that several wiki actions and preference settings in MoinMoin were not protected from cross-site request forgery . If an authenticated user were tricked into visiting a malicious website while logged into MoinMoin, a remote attacker could change the user�s configuration or wiki content. It was discovered that MoinMoin did not properly sanitize its input when processing user preferences. An attacker could enter malicious content which when viewed by a user, could render in unexpected ways | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-911-1 CVE-2010-0668 CVE-2010-0717 CVE-2010-0669 | Version: | 5 |
| Platform(s): | Ubuntu 8.04 Ubuntu 8.10 Ubuntu 9.10 Ubuntu 6.06 Ubuntu 9.04 | Product(s): | moin |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:15278 | |||
| Oval ID: | oval:org.mitre.oval:def:15278 | ||
| Title: | DSA-2321-1 moin -- cross-site scripting | ||
| Description: | A cross-site scriping vulnerability was discovered in the rst parser of Moin, a Python clone of WikiWiki. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2321-1 CVE-2011-1058 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | moin |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:18244 | |||
| Oval ID: | oval:org.mitre.oval:def:18244 | ||
| Title: | DSA-2024-1 moin - cross-site scripting | ||
| Description: | Jamie Strandboge discovered that moin, a python clone of WikiWiki, does not sufficiently sanitise the page name in "Despam" action, allowing remote attackers to perform cross-site scripting (XSS) attacks. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2024-1 CVE-2010-0828 | Version: | 7 |
| Platform(s): | Debian GNU/Linux 5.0 | Product(s): | moin |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:18433 | |||
| Oval ID: | oval:org.mitre.oval:def:18433 | ||
| Title: | DSA-2014-1 moin - several vulnerabilities | ||
| Description: | Several vulnerabilities have been discovered in moin, a python clone of WikiWiki. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2014-1 CVE-2010-0668 CVE-2010-0669 CVE-2010-0717 | Version: | 7 |
| Platform(s): | Debian GNU/Linux 5.0 | Product(s): | moin |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:7093 | |||
| Oval ID: | oval:org.mitre.oval:def:7093 | ||
| Title: | DSA-2024 moin -- insufficient input sanitising | ||
| Description: | Jamie Strandboge discovered that moin, a python clone of WikiWiki, does not sufficiently sanitise the page name in "Despam" action, allowing remote attackers to perform cross-site scripting attacks. In addition, this update fixes a minor issue in the "textcha" protection, it could be trivially bypassed by blanking the "textcha-question" and "textcha-answer" form fields. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2024 CVE-2010-0828 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 | Product(s): | moin |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:7566 | |||
| Oval ID: | oval:org.mitre.oval:def:7566 | ||
| Title: | DSA-2014 moin -- several vulnerabilities | ||
| Description: | Several vulnerabilities have been discovered in moin, a python clone of WikiWiki. The Common Vulnerabilities and Exposures project identifies the following problems: Multiple security issues in MoinMoin related to configurations that have a non-empty superuser list, the xmlrpc action enabled, the SyncPages action enabled, or OpenID configured. MoinMoin does not properly sanitise user profiles. The default configuration of cfg.packagepages_actions_excluded in MoinMoin does not prevent unsafe package actions. In addition, this update fixes an error when processing hierarchical ACLs, which can be exploited to access restricted sub-pages. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2014 CVE-2010-0668 CVE-2010-0669 CVE-2010-0717 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 | Product(s): | moin |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-10-22 | Name : Gentoo Security Advisory GLSA 201210-02 (MoinMoin) File : nvt/glsa_201210_02.nasl |
| 2012-10-12 | Name : Ubuntu Update for moin USN-1604-1 File : nvt/gb_ubuntu_USN_1604_1.nasl |
| 2012-09-07 | Name : FreeBSD Ports: moinmoin File : nvt/freebsd_moinmoin7.nasl |
| 2011-10-16 | Name : Debian Security Advisory DSA 2321-1 (moin) File : nvt/deb_2321_1.nasl |
| 2011-03-08 | Name : Fedora Update for moin FEDORA-2011-2156 File : nvt/gb_fedora_2011_2156_moin_fc14.nasl |
| 2011-03-08 | Name : Fedora Update for moin FEDORA-2011-2157 File : nvt/gb_fedora_2011_2157_moin_fc13.nasl |
| 2011-01-24 | Name : FreeBSD Ports: moinmoin File : nvt/freebsd_moinmoin6.nasl |
| 2010-08-30 | Name : Ubuntu Update for moin vulnerabilities USN-977-1 File : nvt/gb_ubuntu_USN_977_1.nasl |
| 2010-08-21 | Name : Debian Security Advisory DSA 2083-1 (moin) File : nvt/deb_2083_1.nasl |
| 2010-07-05 | Name : MoinMoin 'PageEditor.py' Cross-Site Scripting Vulnerability File : nvt/gb_moinmoin_40549.nasl |
| 2010-06-18 | Name : Fedora Update for moin FEDORA-2010-9857 File : nvt/gb_fedora_2010_9857_moin_fc12.nasl |
| 2010-06-18 | Name : Fedora Update for moin FEDORA-2010-9876 File : nvt/gb_fedora_2010_9876_moin_fc11.nasl |
| 2010-04-13 | Name : MoinMoin Wiki Security Bypass Vulnerability File : nvt/gb_moinmoin_wiki_bypass_vuln.nasl |
| 2010-04-13 | Name : MoinMoin 'Despam' Action Cross-Site Scripting Vulnerability File : nvt/gb_moinmoin_wiki_xss_vuln.nasl |
| 2010-04-09 | Name : Fedora Update for moin FEDORA-2010-6012 File : nvt/gb_fedora_2010_6012_moin_fc11.nasl |
| 2010-04-09 | Name : Ubuntu Update for moin vulnerabilities USN-925-1 File : nvt/gb_ubuntu_USN_925_1.nasl |
| 2010-04-09 | Name : Fedora Update for moin FEDORA-2010-6134 File : nvt/gb_fedora_2010_6134_moin_fc12.nasl |
| 2010-03-12 | Name : Ubuntu Update for moin vulnerabilities USN-911-1 File : nvt/gb_ubuntu_USN_911_1.nasl |
| 2010-03-05 | Name : MoinMoin Wiki User Profile Unspecified Vulnerability File : nvt/gb_moinmoin_wiki_user_prof_unspecified_vuln.nasl |
| 2010-03-05 | Name : MoinMoin Wiki Superuser Lists Unspecified Vulnerability File : nvt/gb_moinmoin_wiki_su_list_unspecified_vuln.nasl |
| 2010-03-05 | Name : MoinMoin Wiki 'cfg' Package Configuration Unspecified Vulnerability File : nvt/gb_moinmoin_wiki_cfg_pkg_unspecified_vuln.nasl |
| 2010-03-02 | Name : Fedora Update for moin FEDORA-2010-1712 File : nvt/gb_fedora_2010_1712_moin_fc12.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 71025 | MoinMoin reStructuredText Parser refuri Parameter XSS MoinMoin contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the input passed via the 'refuri' node attribute upon submission to the reStructuredText parser in 'parser/text_rst.py'. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server. |
| 66908 | MoinMoin action/recoverpass.py Unspecified Parameter XSS |
| 66907 | MoinMoin action/newaccount.py Unspecified Parameter XSS |
| 66906 | MoinMoin action/login.py Unspecified Parameter XSS |
| 66905 | MoinMoin action/backup.py Unspecified Parameter XSS |
| 66904 | MoinMoin action/RenamePage.py Unspecified Parameter XSS |
| 66903 | MoinMoin action/Load.py Unspecified Parameter XSS |
| 66902 | MoinMoin action/CopyPage.py Unspecified Parameter XSS |
| 66901 | MoinMoin PageGraphicalEditor.py Unspecified Parameter XSS |
| 66900 | MoinMoin Page.py Unspecified Parameter XSS |
| 66899 | MoinMoin action/userprofile.py Unspecified Parameter XSS |
| 66898 | MoinMoin action/chart.py Unspecified Parameter XSS |
| 66897 | MoinMoin action/LikePages.py Unspecified Parameter XSS |
| 66896 | MoinMoin action/language_setup.py Unspecified Parameter XSS |
| 66895 | MoinMoin action/anywikidraw.py Unspecified Parameter XSS |
| 66894 | MoinMoin action/SlideShow.py Unspecified Parameter XSS |
| 65065 | MoinMoin PageEditor.py template Parameter XSS MoinMoin contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'template' parameter upon submission to the 'PageEditor.py' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server. |
| 63619 | MoinMoin Multiple Field Textcha Protection Mechanism Bypass |
| 63362 | MoinMoin Despam.py Page Name XSS MoinMoin contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the page name upon submission to the Despam.py script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server. |
| 62655 | MoinMoin User Profile Sanitization Weakness |
| 62654 | MoinMoin cfg.packagepages_actions_excluded Default Configuration Unspecified ... |
| 62043 | MoinMoin Superuser Definition Unspecified Issue |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2012-10-19 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201210-02.nasl - Type : ACT_GATHER_INFO |
| 2012-10-12 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-1604-1.nasl - Type : ACT_GATHER_INFO |
| 2012-09-05 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_4a8a98abf74511e18bd80022156e8794.nasl - Type : ACT_GATHER_INFO |
| 2011-10-11 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2321.nasl - Type : ACT_GATHER_INFO |
| 2011-03-07 | Name : The remote Fedora host is missing a security update. File : fedora_2011-2157.nasl - Type : ACT_GATHER_INFO |
| 2011-03-07 | Name : The remote Fedora host is missing a security update. File : fedora_2011-2156.nasl - Type : ACT_GATHER_INFO |
| 2011-03-03 | Name : The remote Fedora host is missing a security update. File : fedora_2011-2219.nasl - Type : ACT_GATHER_INFO |
| 2011-01-19 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_4c0173451d8911e0bbee0014a5e3cda6.nasl - Type : ACT_GATHER_INFO |
| 2010-08-26 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-977-1.nasl - Type : ACT_GATHER_INFO |
| 2010-08-04 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2083.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-6180.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-6134.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-6012.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-3263.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-1743.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-1712.nasl - Type : ACT_GATHER_INFO |
| 2010-06-07 | Name : A wiki application on the remote web server has a cross-site scripting vulner... File : moinmoin_pageeditor_xss.nasl - Type : ACT_ATTACK |
| 2010-04-09 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-925-1.nasl - Type : ACT_GATHER_INFO |
| 2010-04-01 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2024.nasl - Type : ACT_GATHER_INFO |
| 2010-03-15 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2014.nasl - Type : ACT_GATHER_INFO |
| 2010-03-12 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-911-1.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:37:37 |
|
