Executive Summary
| Summary | |
|---|---|
| Title | MoinMoin vulnerability |
| Informations | |||
|---|---|---|---|
| Name | USN-421-1 | First vendor Publication | 2007-02-10 |
| Vendor | Ubuntu | Last vendor Modification | 2007-02-10 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 4.3 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A security issue affects the following Ubuntu releases: Ubuntu 5.10 Ubuntu 6.06 LTS Ubuntu 6.10 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 5.10: Ubuntu 6.06 LTS: Ubuntu 6.10: In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: A flaw was discovered in MoinMoin's page name sanitizer which could lead to a cross-site scripting attack. By tricking a user into viewing a crafted MoinMoin page, an attacker could execute arbitrary JavaScript as the current MoinMoin user, possibly exposing the user's authentication information for the domain where MoinMoin was hosted. |
Original Source
| Url : http://www.ubuntu.com/usn/USN-421-1 |
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-03-23 | Name : Ubuntu Update for moin, moin1.3 vulnerability USN-421-1 File : nvt/gb_ubuntu_USN_421_1.nasl |
| 2008-09-04 | Name : FreeBSD Ports: moinmoin File : nvt/freebsd_moinmoin1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 31874 | MoinMoin Page Info Field XSS MoinMoin contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not escape the page info field in an unknown script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity. |
| 31873 | MoinMoin AttachFile Page Name XSS |
| 31872 | MoinMoin RenamePage Page Name XSS |
| 31871 | MoinMoin LocalSiteMap Page Name XSS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2008-02-26 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_f113bbebe3ac11dcbb89000bcdc1757a.nasl - Type : ACT_GATHER_INFO |
| 2007-11-10 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-421-1.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 12:04:10 |
|
