Unspecified vulnerability in MoinMoin 1.5.x through 1.7.x, 1.8.x before 1.8.7, and 1.9.x before 1.9.2 has unknown impact and attack vectors, related to configurations that have a non-empty superuser list, the xmlrpc action enabled, the SyncPages action enabled, or OpenID configured.

The remote host is affected by the vulnerability described in GLSA-201210-02 (MoinMoin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MoinMoin. Please review       the CVE identifiers referenced below for details.
  Impact :

    These vulnerabilities in MoinMoin allow remote users to inject arbitrary       web script or HTML, to obtain sensitive information and to bypass the       textcha protection mechanism. There are several other unknown impacts and       attack vectors.
  Workaround :

    There is no known workaround at this time.

- Fixed major security issues in miscellaneous parts of     moin -     http://hg.moinmo.in/moin/1.8/raw-file/1.8.7/docs/CHANGES
    - http://secunia.com/advisories/38444/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in moin, a python clone of WikiWiki. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-0668     Multiple security issues in MoinMoin related to     configurations that have a non-empty superuser list, the     xmlrpc action enabled, the SyncPages action enabled, or     OpenID configured.

  - CVE-2010-0669     MoinMoin does not properly sanitize user profiles.

  - CVE-2010-0717     The default configuration of     cfg.packagepages_actions_excluded in MoinMoin does not     prevent unsafe package actions.

In addition, this update fixes an error when processing hierarchical ACLs, which can be exploited to access restricted sub-pages.

It was discovered that several wiki actions and preference settings in MoinMoin were not protected from cross-site request forgery (CSRF). If an authenticated user were tricked into visiting a malicious website while logged into MoinMoin, a remote attacker could change the user's configuration or wiki content. (CVE-2010-0668, CVE-2010-0717)

It was discovered that MoinMoin did not properly sanitize its input when processing user preferences. An attacker could enter malicious content which when viewed by a user, could render in unexpected ways.
(CVE-2010-0669).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
62632	GLSA-201210-02 : MoinMoin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
47269	Fedora 11 : moin-1.8.7-1.fc11 (2010-1743)	Nessus	Fedora Local Security Checks	medium
47264	Fedora 12 : moin-1.8.7-1.fc12 (2010-1712)	Nessus	Fedora Local Security Checks	medium
45056	Debian DSA-2014-1 : moin - several vulnerabilities	Nessus	Debian Local Security Checks	high
45042	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : moin vulnerabilities (USN-911-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2010-0668

medium

Tenable Plugins

high

medium

medium

high

high