Info

Disclosure

Feb 08, 2007

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

MoinMoin contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not escape the page info field in an unknown script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

Classification

Location: Remote/Network Access Required
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Unknown
OSVDB: Web Related

Solution

Upgrade to version 1.5.7 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

MoinMoin	MoinMoin	0.x
		1.0
		1.1
		1.2
		1.2.x
		1.4
		1.5.0
		1.5.1
		1.5.2
		1.5.3
		1.5.4
		1.5.5
		1.5.6
		1.3.x

References

CVE ID: 2007-0857 (see also: NVD)
Bugtraq ID: 22506
Secunia Advisory ID: 24096 24117
Related OSVDB ID: 31871 31872 31873
ISS X-Force ID: 32377
FrSIRT Advisory: ADV-2007-0553
Vendor URL: http://moinmoin.wikiwikiweb.de
Vendor Specific News/Changelog Entry: http://moinmoin.wikiwikiweb.de/MoinMoinRelease1.5/CHANGES
Other Advisory URL: http://www.ubuntu.com/usn/usn-421-1

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/36218