CVE-2009-0312

Cross-site scripting (XSS) vulnerability in the antispam feature (security/antispam.py) in MoinMoin 1.7 and 1.8.1 allows remote attackers to inject arbitrary web script or HTML via crafted, disallowed content.

Published Bycve@mitre.org

Published DateJan 28, 2009, 01:30

Affected Versions(1)

moin(PyPI)

Introduced0

Fixed1.8.2

LimitN/A

Package (Ecosystem)	Introduced	Fixed	Limit
moin(PyPI)	0	1.8.2	N/A

Weakness Type (CWE):CWE-79

CVSS Metrics

Base Score

4.3

Vector String

AV:N/AC:M/Au:N/C:N/I:P/A:N

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

NONE

Integrity (I)

PARTIAL

Availability (A)

NONE

References

http://hg.moinmo.in/moin/1.7/rev/89b91bf87dad
http://hg.moinmo.in/moin/1.8/rev/89b91bf87dad
http://moinmo.in/SecurityFixes#moin1.8.1
http://osvdb.org/51632
http://secunia.com/advisories/33716
http://secunia.com/advisories/33755
http://www.openwall.com/lists/oss-security/2009/01/27/4
https://exchange.xforce.ibmcloud.com/vulnerabilities/48306
https://usn.ubuntu.com/716-1/
https://www.debian.org/security/2009/dsa-1715

Weakness Type (CWE):CWE-79

CVSS Metrics

Base Score

4.3

Vector String

AV:N/AC:M/Au:N/C:N/I:P/A:N

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

NONE

Integrity (I)

PARTIAL

Availability (A)

NONE