MoinMoin vulnerabilities

2007-05-0800:00:00

ubuntu.com

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

AI Score

6.5

Confidence

Low

EPSS

0.009

Percentile

82.9%

JSON

Releases

Ubuntu 7.04
Ubuntu 6.10
Ubuntu 6.06

Details

A flaw was discovered in MoinMoin’s error reporting when using the
AttachFile action. By tricking a user into viewing a crafted MoinMoin
URL, an attacker could execute arbitrary JavaScript as the current
MoinMoin user, possibly exposing the user’s authentication information
for the domain where MoinMoin was hosted. (CVE-2007-2423)

Flaws were discovered in MoinMoin’s ACL handling for calendars and
includes. Unauthorized users would be able to read pages that would
otherwise be unavailable to them.

OSVersionArchitecturePackageVersionFilename
Ubuntu7.04noarchpython-moinmoin< 1.5.3-1.1ubuntu3.1UNKNOWN
Ubuntu6.10noarchpython2.4-moinmoin< 1.5.3-1ubuntu1.3UNKNOWN
Ubuntu6.06noarchpython2.4-moinmoin< 1.5.2-1ubuntu2.3UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	7.04	noarch	python-moinmoin	< 1.5.3-1.1ubuntu3.1	UNKNOWN
Ubuntu	6.10	noarch	python2.4-moinmoin	< 1.5.3-1ubuntu1.3	UNKNOWN
Ubuntu	6.06	noarch	python2.4-moinmoin	< 1.5.2-1ubuntu2.3	UNKNOWN