CVE-2016-7148 MoinMoin Cross-site Scripting (XSS) vulnerability
MediumCVSS 6.1
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation" approach, related to a "Cross Site Scripting (XSS)" issue affecting the action=AttachFile (via page name) component.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi moin(PyPI) | < 1.9.9 | 1.9.9 |
| pypi moin(PyPI) | = 1.8.4 | No fix listed |
| pypi moin(PyPI) | = 1.8.5 | No fix listed |
| pypi moin(PyPI) | = 1.8.6 | No fix listed |
| pypi moin(PyPI) | = 1.8.7 | No fix listed |
| pypi moin(PyPI) | = 1.9.0 | No fix listed |
| pypi moin(PyPI) | = 1.9.1 | No fix listed |
| pypi moin(PyPI) | = 1.9.2 | No fix listed |
| pypi moin(PyPI) | = 1.9.3 | No fix listed |
| pypi moin(PyPI) | = 1.9.4 | No fix listed |
| pypi moin(PyPI) | = 1.9.5 | No fix listed |
| pypi moin(PyPI) | = 1.9.6 | No fix listed |
| pypi moin(PyPI) | = 1.9.7 | No fix listed |
| pypi moin(PyPI) | = 1.9.8 | No fix listed |
| pypi moin(PyPI) | <= 1.9.8 | No fix listed |
| moinmoin | = 1.9.8 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com product
- github.com
- web.archive.org
- web.archive.org
- www.debian.org
- www.ubuntu.com
- www.curesec.com exploit technical-description third-party-advisory
- 94259 vdb-entry
- USN-3137-1 vendor-advisory
- DSA-3715 vendor-advisory
- github.com vendor-advisory