Media

malicious SVG attachment causing stored XSS vulnerability

Publicada: 11.11.2020
Actualizado: 11.10.2026 13:19

Impact

An attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki.

Patches

Users are strongly advised to upgrade to a patched version.

MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.

Workarounds

It is not advised to work around this, but to upgrade MoinMoin to a patched version.

That said, a work around via a Content Security Policy in the web server might be possible.

Also, it is of course helpful if you give write permissions (which include uploading attachments) only to trusted users.

For more information

If you have any questions or comments about this advisory, email me at twaldmann@thinkmo.de.

Credits

This vulnerability was discovered by:

Catarina Leite from the Checkmarx SCA AppSec team

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Python (PyPI)	moin	< 1.9.11	1.9.11

Referencias

Puntuación CVSS 8.7/10

Vector CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Debilidad (CWE): CWE-79
Plataforma: Python (PyPI)
Paquete: moin
Publicada: 11.11.2020
Actualizado: 11.10.2026 13:19

Fuentes y licencias

OSV / GitHub Advisory Database - PYSEC-2020-241 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-4q96-6xhq-ff43 - CC BY 4.0

Historial de vulnerabilidades: moin

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (41) en el archivo

Entradas en total: 41
Primera → última: 04.2008 05.2022
Sin corrección: 5
Explotada en ataques: 0

Distribución por gravedad

Alta 11
Media 30

Divulgaciones por año

2017: 1
2018: 1
2019: 0
2020: 2
2021: 0
2022: 14
2023: 0
2024: 0
2025: 0
2026: 0

antes: 23

29.04.2022

MoinMoin Improper Privilege Management

Alta CVE-2004-1463 < 1.2.3 1.2.3
29.04.2022

MoinMoin Improper Access Control

Alta CVE-2004-1462 < 1.2.3 1.2.3
29.04.2022

MoinMoin allows administrative access

Alta CVE-2004-0708 < 1.2.2 1.2.2
11.11.2020

malicious SVG attachment causing stored XSS vulnerability esta entrada

Media · 8.7 CVE-2020-15275 < 1.9.11 1.9.11
10.11.2020

MoinMoin vulnerable to remote code execution via cache action

Alta · 8.8 CVE-2020-25074 < 1.9.11 1.9.11
29.03.2010

MoinMoin 1.7.x before 1.7.3 and 1.8.x before 1.8.3 checks parent ACLs in certain inappropriate circumstances during processing of hierarchical ACLs, which allows remote attackers to bypass intended ac

Alta · 7.5 CVE-2009-4762 >= 1.7, < 1.7.3, >= 1.8, < 1.8.3 1.7.3, 1.8.3
26.02.2010

MoinMoin before 1.8.7 and 1.9.x before 1.9.2 does not properly sanitize user profiles, which has unspecified impact and attack vectors.

Alta CVE-2010-0669 < 1.8.7, >= 1.9, < 1.9.2 1.8.7, 1.9.2
26.02.2010

The default configuration of cfg.packagepages_actions_excluded in MoinMoin before 1.8.7 does not prevent unsafe package actions, which has unspecified impact and attack vectors.

Alta CVE-2010-0717 < 1.8.7 1.8.7
26.02.2010

MoinMoin 1.9 before 1.9.1 does not perform the expected clearing of the sys.argv array in situations where the GATEWAY_INTERFACE environment variable is set, which allows remote attackers to obtain se

Alta · 7.5 CVE-2010-0667 >= 1.9, < 1.9.1 1.9.1
03.04.2009

MoinMoin 1.6.2 and 1.7 does not properly enforce ACL checks when acl_hierarchic is set to True, which might allow remote attackers to bypass intended access restrictions, a different vulnerability tha

Alta · 7.5 CVE-2008-6603 < 1.6.3, >= 1.7, < 1.7.1 1.6.3, 1.7.1
30.03.2009

MoinMoin Denial of Service vulnerability via password_checker function

Alta · 7.5 CVE-2008-6549 < 1.6.1 1.6.1
25.04.2008

The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage users, which allows remote attackers to gain privileges.

Alta · 7.5 CVE-2008-1937 < 1.6.3, >= 1.7, < 1.7.1 1.6.3, 1.7.1

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación