The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.

MoinMoin reports :

- Security fix for CVE-2020-25074: fix remote code execution via cache action

- Security fix for CVE-2020-15275: fix malicious SVG attachment causing stored XSS vulnerability

This update for moinmoin-wiki fixes the following issues :

  - update to version 1.9.11: CVE-2020-25074 (boo#1178744):
    fix remote code execution via cache action     CVE-2020-15275 (boo#1178745): fix malicious SVG     attachment causing stored XSS vulnerability

Two vulnerabilities were discovered in moin, a Python clone of WikiWiki.

CVE-2020-15275

Catarina Leite discovered that moin is prone to a stored XSS vulnerability via SVG attachments.

CVE-2020-25074

Michael Chapman discovered that moin is prone to a remote code execution vulnerability via the cache action.

For Debian 9 stretch, these problems have been fixed in version 1.9.9-1+deb9u2.

We recommend that you upgrade your moin packages.

For the detailed security status of moin please refer to its security tracker page at: https://security-tracker.debian.org/tracker/moin

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4629-1 advisory.

    Michael Chapman discovered that MoinMoin incorrectly handled certain cache actions. An attacker could     possibly use this issue to execute arbitrary code. (CVE-2020-25074)

    Catarina Leite discovered that MoinMoin incorrectly handled certain SVG files. An attacker could possibly     use this issue to execute arbitrary code. (CVE-2020-15275)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Two vulnerabilities were discovered in moin, a Python clone of WikiWiki.

  - CVE-2020-15275     Catarina Leite discovered that moin is prone to a stored     XSS vulnerability via SVG attachments.

  - CVE-2020-25074     Michael Chapman discovered that moin is prone to a     remote code execution vulnerability via the cache     action.

ID	Name	Product	Family	Severity
145193	FreeBSD : moinmoin -- multiple vulnerabilities (abed4ff0-7da1-4236-880d-de33e4895315)	Nessus	FreeBSD Local Security Checks	critical
143145	openSUSE Security Update : moinmoin-wiki (openSUSE-2020-1966)	Nessus	SuSE Local Security Checks	critical
142845	Debian DLA-2446-1 : moin security update	Nessus	Debian Local Security Checks	critical
142736	Ubuntu 16.04 LTS / 18.04 LTS : MoinMoin vulnerabilities (USN-4629-1)	Nessus	Ubuntu Local Security Checks	critical
142664	Debian DSA-4787-1 : moin - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2020-25074

critical

Tenable Plugins

critical

critical

critical

critical

critical