Sign in
Deutsch English Español Polski
Medium

malicious SVG attachment causing stored XSS vulnerability

  • Disclosed: 11.11.2020
  • Updated: 11.10.2026 13:19

Impact

An attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki.

Patches

Users are strongly advised to upgrade to a patched version.

MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.

Workarounds

It is not advised to work around this, but to upgrade MoinMoin to a patched version.

That said, a work around via a Content Security Policy in the web server might be possible.

Also, it is of course helpful if you give write permissions (which include uploading attachments) only to trusted users.

For more information

If you have any questions or comments about this advisory, email me at twaldmann@thinkmo.de.

Credits

This vulnerability was discovered by:

Catarina Leite from the Checkmarx SCA AppSec team

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) moin < 1.9.11 1.9.11

References

CVSS score 8.7/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Weakness (CWE)
CWE-79
Platform
Python (PyPI)
Package
moin
Disclosed
11.11.2020
Updated
11.10.2026 13:19

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2020-241 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-4q96-6xhq-ff43 - CC BY 4.0

Vulnerability history: moin

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (41) in the archive
Total entries
41
First → latest
04.2008 05.2022
Without a fix
5
Exploited in attacks
0

Severity breakdown

  • High 11
  • Medium 30

Disclosures per year

earlier: 23

Severity:
  1. MoinMoin Improper Privilege Management
    High CVE-2004-1463 < 1.2.3 1.2.3
  2. MoinMoin Improper Access Control
    High CVE-2004-1462 < 1.2.3 1.2.3
  3. MoinMoin allows administrative access
    High CVE-2004-0708 < 1.2.2 1.2.2
  4. malicious SVG attachment causing stored XSS vulnerability this entry
    Medium · 8.7 CVE-2020-15275 < 1.9.11 1.9.11
  5. MoinMoin vulnerable to remote code execution via cache action
    High · 8.8 CVE-2020-25074 < 1.9.11 1.9.11
  6. MoinMoin 1.7.x before 1.7.3 and 1.8.x before 1.8.3 checks parent ACLs in certain inappropriate circumstances during processing of hierarchical ACLs, which allows remote attackers to bypass intended ac
    High · 7.5 CVE-2009-4762 >= 1.7, < 1.7.3, >= 1.8, < 1.8.3 1.7.3, 1.8.3
  7. MoinMoin before 1.8.7 and 1.9.x before 1.9.2 does not properly sanitize user profiles, which has unspecified impact and attack vectors.
    High CVE-2010-0669 < 1.8.7, >= 1.9, < 1.9.2 1.8.7, 1.9.2
  8. The default configuration of cfg.packagepages_actions_excluded in MoinMoin before 1.8.7 does not prevent unsafe package actions, which has unspecified impact and attack vectors.
    High CVE-2010-0717 < 1.8.7 1.8.7
  9. MoinMoin 1.9 before 1.9.1 does not perform the expected clearing of the sys.argv array in situations where the GATEWAY_INTERFACE environment variable is set, which allows remote attackers to obtain se
    High · 7.5 CVE-2010-0667 >= 1.9, < 1.9.1 1.9.1
  10. MoinMoin 1.6.2 and 1.7 does not properly enforce ACL checks when acl_hierarchic is set to True, which might allow remote attackers to bypass intended access restrictions, a different vulnerability tha
    High · 7.5 CVE-2008-6603 < 1.6.3, >= 1.7, < 1.7.1 1.6.3, 1.7.1
  11. MoinMoin Denial of Service vulnerability via password_checker function
    High · 7.5 CVE-2008-6549 < 1.6.1 1.6.1
  12. The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage users, which allows remote attackers to gain privileges.
    High · 7.5 CVE-2008-1937 < 1.6.3, >= 1.7, < 1.7.1 1.6.3, 1.7.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.