MoinMoin before 1.8.7 and 1.9.x before 1.9.2 does not properly sanitize user profiles, which has unspecified impact and attack vectors.

The remote host is affected by the vulnerability described in GLSA-201210-02 (MoinMoin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MoinMoin. Please review       the CVE identifiers referenced below for details.
  Impact :

    These vulnerabilities in MoinMoin allow remote users to inject arbitrary       web script or HTML, to obtain sensitive information and to bypass the       textcha protection mechanism. There are several other unknown impacts and       attack vectors.
  Workaround :

    There is no known workaround at this time.

New upstream release containing security fixes for CVE-2010-0668 and CVE-2010-0669

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in moin, a python clone of WikiWiki. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-0668     Multiple security issues in MoinMoin related to     configurations that have a non-empty superuser list, the     xmlrpc action enabled, the SyncPages action enabled, or     OpenID configured.

  - CVE-2010-0669     MoinMoin does not properly sanitize user profiles.

  - CVE-2010-0717     The default configuration of     cfg.packagepages_actions_excluded in MoinMoin does not     prevent unsafe package actions.

In addition, this update fixes an error when processing hierarchical ACLs, which can be exploited to access restricted sub-pages.

It was discovered that several wiki actions and preference settings in MoinMoin were not protected from cross-site request forgery (CSRF). If an authenticated user were tricked into visiting a malicious website while logged into MoinMoin, a remote attacker could change the user's configuration or wiki content. (CVE-2010-0668, CVE-2010-0717)

It was discovered that MoinMoin did not properly sanitize its input when processing user preferences. An attacker could enter malicious content which when viewed by a user, could render in unexpected ways.
(CVE-2010-0669).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
62632	GLSA-201210-02 : MoinMoin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
47304	Fedora 13 : moin-1.9.2-1.fc13 (2010-3263)	Nessus	Fedora Local Security Checks	high
45056	Debian DSA-2014-1 : moin - several vulnerabilities	Nessus	Debian Local Security Checks	high
45042	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : moin vulnerabilities (USN-911-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2010-0669

high

Tenable Plugins

high

high

high

high