MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation or crafted URL" approach, related to a "Cross Site Scripting (XSS)" issue affecting the action=fckdialog&dialog=attachment (via page name) component.

Thomas Waldmann reports :

- fix XSS in AttachFile view (multifile related) CVE-2016-7148

- fix XSS in GUI editor's attachment dialogue CVE-2016-7146

- fix XSS in GUI editor's link dialogue CVE-2016-9119

Update to 1.9.9 (bugfix release for CVE-2016-7146, CVE-2016-7148)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3137-1 advisory.

    It was discovered that MoinMoin did not properly sanitize certain inputs, resulting in cross-site     scripting (XSS) vulnerabilities. With cross-site scripting vulnerabilities, if a user were tricked into     viewing server output during a crafted server request, a remote attacker could exploit this to modify the     contents, or steal confidential data, within the same domain.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several cross-site scripting vulnerabilities were discovered in moin, a Python clone of WikiWiki. A remote attacker can conduct cross-site scripting attacks via the GUI editor's attachment dialogue (CVE-2016-7146) and the GUI editor's link dialogue (CVE-2016-9119).

For Debian 7 'Wheezy', these problems have been fixed in version 1.9.4-8+deb7u3.

We recommend that you upgrade your moin packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several cross-site scripting vulnerabilities were discovered in moin, a Python clone of WikiWiki. A remote attacker can conduct cross-site scripting attacks via the GUI editor's attachment dialogue (CVE-2016-7146 ), the AttachFile view (CVE-2016-7148 ) and the GUI editor's link dialogue (CVE-2016-9119 ).

ID	Name	Product	Family	Severity
96370	FreeBSD : moinmoin -- XSS vulnerabilities (ab804e60-d693-11e6-9171-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	medium
95461	Fedora 24 : moin (2016-d40c768095)	Nessus	Fedora Local Security Checks	medium
95460	Fedora 23 : moin (2016-a77985b7c7)	Nessus	Fedora Local Security Checks	medium
95449	Fedora 25 : moin (2016-cde4525fab)	Nessus	Fedora Local Security Checks	medium
95318	Ubuntu 14.04 LTS / 16.04 LTS : MoinMoin vulnerabilities (USN-3137-1)	Nessus	Ubuntu Local Security Checks	medium
95262	Debian DLA-717-1 : moin security update	Nessus	Debian Local Security Checks	medium
94902	Debian DSA-3715-1 : moin - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2016-7146

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium