| Vulnerability Name: | CVE-2010-2970 (CCN-59131) | ||||||||
| Assigned: | 2010-06-03 | ||||||||
| Published: | 2010-06-03 | ||||||||
| Updated: | 2010-08-05 | ||||||||
| Summary: | Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/SlideShow.py, (2) action/anywikidraw.py, and (3) action/language_setup.py, a similar issue to CVE-2010-2487. | ||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
| ||||||||
| CVSS v2 Severity: | 4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N) 3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-79 | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: CONFIRM Type: UNKNOWN http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809 Source: MITRE Type: CNA CVE-2010-2487 Source: MITRE Type: CNA CVE-2010-2969 Source: MITRE Type: CNA CVE-2010-2970 Source: CONFIRM Type: UNKNOWN http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES Source: CONFIRM Type: UNKNOWN http://hg.moinmo.in/moin/1.9/rev/4fe9951788cb Source: CONFIRM Type: UNKNOWN http://hg.moinmo.in/moin/1.9/rev/e50b087c4572 Source: MLIST Type: UNKNOWN [oss-security] 20100701 CVE request: moin multiple XSS Source: MLIST Type: UNKNOWN [oss-security] 20100702 Re: CVE request: moin multiple XSS Source: CONFIRM Type: Vendor Advisory http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg Source: CONFIRM Type: UNKNOWN http://moinmo.in/MoinMoinRelease1.9 Source: CCN Type: MoinMoin Web Site Security Fix Announcements Source: CONFIRM Type: Vendor Advisory http://moinmo.in/SecurityFixes Source: CCN Type: SA40043 MoinMoin Multiple Cross-Site Scripting Vulnerabilities Source: SECUNIA Type: Vendor Advisory 40836 Source: DEBIAN Type: UNKNOWN DSA-2083 Source: DEBIAN Type: DSA-2083 moin -- missing input sanitization Source: CCN Type: OSVDB ID: 65065 MoinMoin PageEditor.py template Parameter XSS Source: CCN Type: OSVDB ID: 66894 MoinMoin action/SlideShow.py Unspecified Parameter XSS Source: CCN Type: OSVDB ID: 66895 MoinMoin action/anywikidraw.py Unspecified Parameter XSS Source: CCN Type: OSVDB ID: 66896 MoinMoin action/language_setup.py Unspecified Parameter XSS Source: CCN Type: OSVDB ID: 66897 MoinMoin action/LikePages.py Unspecified Parameter XSS Source: CCN Type: OSVDB ID: 66898 MoinMoin action/chart.py Unspecified Parameter XSS Source: CCN Type: OSVDB ID: 66899 MoinMoin action/userprofile.py Unspecified Parameter XSS Source: CCN Type: OSVDB ID: 66900 MoinMoin Page.py Unspecified Parameter XSS Source: CCN Type: OSVDB ID: 66901 MoinMoin PageGraphicalEditor.py Unspecified Parameter XSS Source: CCN Type: OSVDB ID: 66902 MoinMoin action/CopyPage.py Unspecified Parameter XSS Source: CCN Type: OSVDB ID: 66903 MoinMoin action/Load.py Unspecified Parameter XSS Source: CCN Type: OSVDB ID: 66904 MoinMoin action/RenamePage.py Unspecified Parameter XSS Source: CCN Type: OSVDB ID: 66905 MoinMoin action/backup.py Unspecified Parameter XSS Source: CCN Type: OSVDB ID: 66906 MoinMoin action/login.py Unspecified Parameter XSS Source: CCN Type: OSVDB ID: 66907 MoinMoin action/newaccount.py Unspecified Parameter XSS Source: CCN Type: OSVDB ID: 66908 MoinMoin action/recoverpass.py Unspecified Parameter XSS Source: BID Type: UNKNOWN 40549 Source: CCN Type: BID-40549 MoinMoin 'PageEditor.py' Cross-Site Scripting Vulnerability Source: VUPEN Type: Vendor Advisory ADV-2010-1981 Source: XF Type: UNKNOWN moinmoin-template-xss(59131) | ||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||