CVE-2007-0901: XSS
First published: Tue Feb 13 2007(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in Info pages in MoinMoin 1.5.7 allow remote attackers to inject arbitrary web script or HTML via the (1) hitcounts and (2) general parameters, different vectors than CVE-2007-0857. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/Moin | <=1.5.7 | 1.5.8 |
| Mastodon | =1.5.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://secunia.com/advisories/24138
- http://www.ubuntu.com/usn/usn-423-1
- http://www.securityfocus.com/bid/22515
- http://secunia.com/advisories/24244
- http://osvdb.org/33172
- https://nvd.nist.gov/vuln/detail/CVE-2007-0901
- https://moinmo.in/MoinMoinRelease1.5/CHANGES
- https://web.archive.org/web/20070214032031/http://secunia.com/advisories/24138/
- https://web.archive.org/web/20070227204439/http://secunia.com/advisories/24244/
- https://web.archive.org/web/20080516214454/http://www.securityfocus.com/bid/22515
- https://github.com/advisories/GHSA-9gj2-ph57-56f5 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2007-0901?
CVE-2007-0901 is considered a moderate severity vulnerability due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2007-0901?
To fix CVE-2007-0901, upgrade to MoinMoin version 1.5.8 or later.
What types of vulnerabilities does CVE-2007-0901 represent?
CVE-2007-0901 represents multiple cross-site scripting (XSS) vulnerabilities in the Info pages of MoinMoin.
Which versions of MoinMoin are affected by CVE-2007-0901?
CVE-2007-0901 affects MoinMoin version 1.5.7 and earlier versions.
Can CVE-2007-0901 allow attackers to execute scripts on the server?
No, CVE-2007-0901 allows attackers to inject scripts only within the context of the victim's browser, not on the server.
- collector/github-advisory-latest
- alias/GHSA-9gj2-ph57-56f5
- alias/CVE-2007-0901
- collector/github-advisory
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/severity
- agent/first-publish-date
- agent/event
- agent/description
- agent/trending
- agent/source
- agent/weakness
- agent/author
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- collector/nvd-cve
- package-manager/pip
- vendor/moinmoin
- canonical/mastodon
- version/mastodon/1.5.7