Published: 26/02/2010 Updated: 31/03/2010

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

MoinMoin prior to 1.8.7 and 1.9.x prior to 1.9.2 does not properly sanitize user profiles, which has unspecified impact and attack vectors.

Vulnerable Product	Search on Vulmon	Subscribe to Product
moinmo moinmoin 1.8.1
moinmo moinmoin 1.8.0
moinmo moinmoin 1.5.0
moinmo moinmoin 1.7.0
moinmo moinmoin 1.5.2
moinmo moinmoin 1.5.3
moinmo moinmoin 1.5.6
moinmo moinmoin 1.5.7
moinmo moinmoin 1.8.3
moinmo moinmoin 1.8.2
moinmo moinmoin 1.6.3
moinmo moinmoin 1.7.3
moinmo moinmoin 1.5.1
moinmo moinmoin 1.5.5
moinmo moinmoin 1.5.5a
moinmo moinmoin 1.6.0
moinmo moinmoin
moinmo moinmoin 1.9.1
moinmo moinmoin 1.9.0
moinmo moinmoin 1.8.4
moinmo moinmoin 1.6.4
moinmo moinmoin 1.7.2
moinmo moinmoin 1.7.1
moinmo moinmoin 1.5.4
moinmo moinmoin 1.6.1
moinmo moinmoin 1.6.2
moinmo moinmoin 1.5.8

Debian Bug report logs - #569975 python-moinmoin: Serious security issue in all moinmoin versions Package: python-moinmoin; Maintainer for python-moinmoin is Steve McIntyre <93sam@debianorg>; Source for python-moinmoin is src:moin (PTS, buildd, popcon) Reported by: John Goerzen <jgoerzen@completeorg> Date: Mon, 15 ...

It was discovered that several wiki actions and preference settings in MoinMoin were not protected from cross-site request forgery (CSRF) If an authenticated user were tricked into visiting a malicious website while logged into MoinMoin, a remote attacker could change the user’s configuration or wiki content (CVE-2010-0668, CVE-2010-0717) ...

NVD-CWE-noinfo http://moinmo.in/MoinMoinRelease1.8 http://secunia.com/advisories/38444 http://www.openwall.com/lists/oss-security/2010/02/15/4 http://www.openwall.com/lists/oss-security/2010/02/15/2 http://hg.moinmo.in/moin/1.8/raw-file/1.8.7/docs/CHANGES http://www.securityfocus.com/bid/38023 http://www.openwall.com/lists/oss-security/2010/02/21/2 http://moinmo.in/SecurityFixes http://www.vupen.com/english/advisories/2010/0600 http://www.debian.org/security/2010/dsa-2014 http://secunia.com/advisories/38903 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=569975 https://usn.ubuntu.com/911-1/https://nvd.nist.gov

CVE-2010-0669

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect