CVE-2010-0828: XSS
Cross-site scripting (XSS) vulnerability in action/Despam.py in the Despam action module in MoinMoin 1.8.7 and 1.9.2 allows remote authenticated users to inject arbitrary web script or HTML by creating a page with a crafted URI.
Other sources
Cross-site scripting (XSS) vulnerability in action/Despam.py in the Despam action module in MoinMoin 1.8.7 and 1.9.2 allows remote authenticated users to inject arbitrary web script or HTML by creating a page with a crafted URI.
— MITRE
Jamie Strandboge of the Ubuntu Security Team reported: [1] https://bugs.launchpad.net/ubuntu/+source/moin/+bug/538022
a cross-site scripting (XSS) flaw, present in the Moin's Despam action module, providing possibility mass to revert changes done by some specific author / bot. Unprivileged Moin user could provide a specially-crafted HTML page and trick the privileged user into running the Despam action on it, leading to disclosure of sensitive information, denial of 'revert changes service' or potentially, to execution of arbitrary JavaScript code with the privileges of the privileged Moin user.
References: [2] http://moinmo.in/SecurityFixes [3] http://secunia.com/advisories/39188/
Upstream patch: [4] http://hg.moinmo.in/moin/1.9/rev/6e603e5411ca
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0828?
The severity of CVE-2010-0828 is considered medium due to the potential for cross-site scripting attacks by authenticated users.
How do I fix CVE-2010-0828?
To fix CVE-2010-0828, upgrade to MoinMoin version 1.8.8 or higher, or version 1.9.3 or higher.
Who is affected by CVE-2010-0828?
CVE-2010-0828 affects users of MoinMoin versions 1.8.7 and 1.9.2.
What type of vulnerability is CVE-2010-0828?
CVE-2010-0828 is a cross-site scripting (XSS) vulnerability.
Can CVE-2010-0828 be exploited by unauthenticated users?
No, CVE-2010-0828 can only be exploited by remote authenticated users.