Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
37 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage users, which allows remote attackers to gain privileges.
Recommended action: Upgrade to 1.6.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in MoinMoin 1.5.x through 1.5.8 and 1.6.x before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the login action.
Recommended action: Upgrade to 1.6.1; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
MoinMoin before 20070507 does not properly enforce ACLs for calendars and includes, which allows remote attackers to read certain pages via unspecified vectors.
Recommended action: Upgrade to 1.5.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple cross-site scripting (XSS) vulnerabilities in Info pages in MoinMoin 1.5.7 allow remote attackers to inject arbitrary web script or HTML via the (1) hitcounts and (2) general parameters, different vectors than CVE-2007-0857. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Recommended action: Upgrade to 1.5.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An information leak was discovered in MoinMoin's debug reporting version 1.5.7, which could expose information about the versions of software running on the host system. MoinMoin administrators can add "showtraceback=0" to their site configurations to disable debug tracebacks.
Recommended action: Upgrade to 1.5.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin before 1.5.7 allow remote attackers to inject arbitrary web script or HTML via (1) the page info, or the page name in a (2) AttachFile, (3) RenamePage, or (4) LocalSiteMap action.
Recommended action: Upgrade to 1.5.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
MoinMoin 1.2.2 and earlier could allow a remote attacker to gain elevated privileges, caused by an undisclosed Access Control List (ACL) vulnerability in the PageEditor.
Recommended action: Upgrade to 1.2.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Unknown vulnerability in MoinMoin 1.2.2 and earlier allows remote attackers to gain unauthorized access to administrator functions such as (1) revert and (2) delete.
Recommended action: Upgrade to 1.2.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
MoinMoin 1.2.1 and earlier allows remote attackers to gain privileges by creating a user with the same name as an existing group that has higher privileges.
Recommended action: Upgrade to 1.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The cache action in action/cache.py allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution. Patches Users are strongly advised to upgrade to a patched version. MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes. Workarounds It is not advised to work around this, but to upgrade MoinMoin to a patched version. That said, a work around via disabling the cache or the AttachFile action might be possible. Also, it is of course helpful if you give write permissions (which include uploading attachments) only to trusted users. Credits This vulnerability was discovered by Michael Chapman. For more information If you have any questions or comments about this advisory, email me at twaldmann@thinkmo.de.
Recommended action: Upgrade to 1.9.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki. Patches Users are strongly advised to upgrade to a patched version. MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes. Workarounds It is not advised to work around this, but to upgrade MoinMoin to a patched version. That said, a work around via a Content Security Policy in the web server might be possible. Also, it is of course helpful if you give write permissions (which include uploading attachments) only to trusted users. For more information If you have any questions or comments about this advisory, email me at twaldmann@thinkmo.de. Credits This vulnerability was discovered by: Catarina Leite from the Checkmarx SCA AppSec team
Recommended action: Upgrade to 1.9.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Recommended action: Upgrade to 1.9.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.