Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | MoinMoin vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | USN-925-1 | First vendor Publication | 2010-04-08 |
| Vendor | Ubuntu | Last vendor Modification | 2010-04-08 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 8.04 LTS Ubuntu 8.10 Ubuntu 9.04 Ubuntu 9.10 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: Ubuntu 8.04 LTS: Ubuntu 8.10: Ubuntu 9.04: Ubuntu 9.10: In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: It was discovered that MoinMoin did not properly sanitize its input when processing Despam actions, resulting in cross-site scripting (XSS) vulnerabilities. If a privileged wiki user were tricked into performing the Despam action on a page with a crafted title, a remote attacker could exploit this to execute JavaScript code. (CVE-2010-0828) It was discovered that the TextCha protection in MoinMoin could be bypassed by submitting a crafted form request. This issue only affected Ubuntu 8.10. (CVE-2010-1238) |
Original Source
| Url : http://www.ubuntu.com/usn/USN-925-1 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 50 % | CWE-264 | Permissions, Privileges, and Access Controls |
| 50 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:13275 | |||
| Oval ID: | oval:org.mitre.oval:def:13275 | ||
| Title: | USN-925-1 -- moin vulnerabilities | ||
| Description: | It was discovered that MoinMoin did not properly sanitize its input when processing Despam actions, resulting in cross-site scripting vulnerabilities. If a privileged wiki user were tricked into performing the Despam action on a page with a crafted title, a remote attacker could exploit this to execute JavaScript code. It was discovered that the TextCha protection in MoinMoin could be bypassed by submitting a crafted form request. This issue only affected Ubuntu 8.10 | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-925-1 CVE-2010-0828 CVE-2010-1238 | Version: | 5 |
| Platform(s): | Ubuntu 8.04 Ubuntu 8.10 Ubuntu 9.10 Ubuntu 6.06 Ubuntu 9.04 | Product(s): | moin |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:18244 | |||
| Oval ID: | oval:org.mitre.oval:def:18244 | ||
| Title: | DSA-2024-1 moin - cross-site scripting | ||
| Description: | Jamie Strandboge discovered that moin, a python clone of WikiWiki, does not sufficiently sanitise the page name in "Despam" action, allowing remote attackers to perform cross-site scripting (XSS) attacks. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2024-1 CVE-2010-0828 | Version: | 7 |
| Platform(s): | Debian GNU/Linux 5.0 | Product(s): | moin |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:7093 | |||
| Oval ID: | oval:org.mitre.oval:def:7093 | ||
| Title: | DSA-2024 moin -- insufficient input sanitising | ||
| Description: | Jamie Strandboge discovered that moin, a python clone of WikiWiki, does not sufficiently sanitise the page name in "Despam" action, allowing remote attackers to perform cross-site scripting attacks. In addition, this update fixes a minor issue in the "textcha" protection, it could be trivially bypassed by blanking the "textcha-question" and "textcha-answer" form fields. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2024 CVE-2010-0828 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 | Product(s): | moin |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 3 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-10-22 | Name : Gentoo Security Advisory GLSA 201210-02 (MoinMoin) File : nvt/glsa_201210_02.nasl |
| 2011-01-24 | Name : FreeBSD Ports: moinmoin File : nvt/freebsd_moinmoin6.nasl |
| 2010-06-18 | Name : Fedora Update for moin FEDORA-2010-9857 File : nvt/gb_fedora_2010_9857_moin_fc12.nasl |
| 2010-06-18 | Name : Fedora Update for moin FEDORA-2010-9876 File : nvt/gb_fedora_2010_9876_moin_fc11.nasl |
| 2010-04-13 | Name : MoinMoin Wiki Security Bypass Vulnerability File : nvt/gb_moinmoin_wiki_bypass_vuln.nasl |
| 2010-04-13 | Name : MoinMoin 'Despam' Action Cross-Site Scripting Vulnerability File : nvt/gb_moinmoin_wiki_xss_vuln.nasl |
| 2010-04-09 | Name : Fedora Update for moin FEDORA-2010-6012 File : nvt/gb_fedora_2010_6012_moin_fc11.nasl |
| 2010-04-09 | Name : Fedora Update for moin FEDORA-2010-6134 File : nvt/gb_fedora_2010_6134_moin_fc12.nasl |
| 2010-04-09 | Name : Ubuntu Update for moin vulnerabilities USN-925-1 File : nvt/gb_ubuntu_USN_925_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 63619 | MoinMoin Multiple Field Textcha Protection Mechanism Bypass |
| 63362 | MoinMoin Despam.py Page Name XSS MoinMoin contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the page name upon submission to the Despam.py script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2012-10-19 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201210-02.nasl - Type : ACT_GATHER_INFO |
| 2011-01-19 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_4c0173451d8911e0bbee0014a5e3cda6.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-6012.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-6134.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-6180.nasl - Type : ACT_GATHER_INFO |
| 2010-04-09 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-925-1.nasl - Type : ACT_GATHER_INFO |
| 2010-04-01 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2024.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 12:06:42 |
|
