Vulnerability Name:

CVE-2020-15275 (CCN-191739)

Assigned:2020-11-08
Published:2020-11-08
Updated:2022-10-18
Summary:MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrade to a patched version. MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.
CVSS v3 Severity:5.4 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
5.2 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:H/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
6.4 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
6.1 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N/E:H/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:3.5 Low (CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
5.5 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-79
Vulnerability Consequences:Cross-Site Scripting
References:Source: MITRE
Type: CNA
CVE-2020-15275

Source: MISC
Type: Exploit, Third Party Advisory
https://advisory.checkmarx.net/advisory/CX-2020-4285

Source: XF
Type: UNKNOWN
moinmoin-cve202015275-xss(191739)

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/moinwiki/moin-1.9/commit/31de9139d0aabc171e94032168399b4a0b2a88a2

Source: MISC
Type: Release Notes, Third Party Advisory
https://github.com/moinwiki/moin-1.9/releases/tag/1.9.11

Source: CCN
Type: MoinMoin GIT Repository
malicious SVG attachment causing stored XSS vulnerability

Source: CONFIRM
Type: Third Party Advisory
https://github.com/moinwiki/moin-1.9/security/advisories/GHSA-4q96-6xhq-ff43

Vulnerable Configuration:Configuration 1:
  • cpe:/a:moinmo:moinmoin:*:*:*:*:*:*:*:* (Version < 1.9.11)

    • Configuration CCN 1:
  • cpe:/a:moinmo:moinmoin:1.9.10:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:202015275
    V
    		CVE-2020-15275
    2022-05-22
    oval:org.opensuse.security:def:64821
    P
    		Security update for python-pip (Moderate)
    2021-12-13
    oval:org.opensuse.security:def:64577
    P
    		Security update for xen (Moderate)
    2021-09-18
    oval:org.opensuse.security:def:64714
    P
    		Security update for tpm2.0-tools (Moderate)
    2021-06-17
    oval:org.opensuse.security:def:64713
    P
    		Security update for the Linux Kernel (Important)
    2021-06-15
    oval:org.opensuse.security:def:65092
    P
    		Security update for ipmitool (Important)
    2020-12-01
    oval:org.opensuse.security:def:75034
    P
    		Security update for postgresql12 (Important)
    2020-12-01
    oval:org.opensuse.security:def:64923
    P
    		Security update for libxml2 (Low)
    2020-12-01
    oval:org.opensuse.security:def:75167
    P
    		Security update for moinmoin-wiki (Important)
    2020-12-01
    oval:org.opensuse.security:def:64980
    P
    		Security update for libssh2_org (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:109738
    P
    		Security update for moinmoin-wiki (Important)
    2020-11-23
    oval:org.opensuse.security:def:96391
    P
    		Security update for moinmoin-wiki (Important)
    2020-11-23
    oval:org.opensuse.security:def:103081
    P
    		Security update for moinmoin-wiki (Important)
    2020-11-23
    oval:org.opensuse.security:def:110862
    P
    		Security update for moinmoin-wiki (Important)
    2020-11-19
    BACK
    moinmo moinmoin *
    moinmo moinmoin 1.9.10