moin 1.9.10: known vulnerabilities

Could not compare 1 record. The results are incomplete.

1. CVE-2020-15275

   High · CVSS 8.7EPSS 1.75%Fix available

   malicious SVG attachment causing stored XSS vulnerability in MoinMoin

   MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrade to a patched version. MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.

   moin moinPython

   • Update to 1.9.11

   Published November 11, 2020Updated August 4, 2024

   Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

2. CVE-2020-25074

   Critical · CVSS 9.8EPSS 6.55%Fix available

   CVE-2020-25074

   The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.

   moin moinPython

   • Update to 1.9.11

   Published November 10, 2020Updated August 4, 2024

   Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

3. CVE-2008-6548

   Medium · CVSS 6.9EPSS 1%No fix published

   CVE-2008-6548

   The rst parser (parser/text_rst.py) in MoinMoin 1.6.1 does not check the ACL of an included page, which allows attackers to read unauthorized include files via unknown vectors.

   moinPython

   Published March 30, 2009Updated September 16, 2024

   Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗