CVE-2007-2423
published 2007-05-02CVE-2007-2423: Cross-site scripting (XSS) vulnerability in index.php in MoinMoin 1.5.7 allows remote attackers to inject arbitrary web script or HTML via the do parameter in…
PriorityP424medium5.8CVSS 2.0
AVNACMAuNCPIPAN
EXPLOIT
EPSS
3.55%
87.9th percentile
Cross-site scripting (XSS) vulnerability in index.php in MoinMoin 1.5.7 allows remote attackers to inject arbitrary web script or HTML via the do parameter in an AttachFile action, a different vulnerability than CVE-2007-0857. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| moinmoin | moinmoin | — | — |
CVSS provenance
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
osv4.3MEDIUM
vendor_ubuntu5.8MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
MoinMoin vulnerabilities
vendor_ubuntu·2007-05-08·CVSS 5.8
CVE-2007-2423 [MEDIUM] MoinMoin vulnerabilities
Title: MoinMoin vulnerabilities
Summary: MoinMoin vulnerabilities
A flaw was discovered in MoinMoin's error reporting when using the
AttachFile action. By tricking a user into viewing a crafted MoinMoin
URL, an attacker could execute arbitrary JavaScript as the current
MoinMoin user, possibly exposing the user's authentication information
for the domain where MoinMoin was hosted. (CVE-2007-2423)
Flaws were discovered in MoinMoin's ACL handling for calendars and
includes. Unauthorized users would be able to read pages that would
otherwise be unavailable to them.
Instructions: In general, a standard system upgrade is sufficient to effect the
necessary changes.
GHSA
GHSA-cxxq-wr83-qfr5: Cross-site scripting (XSS) vulnerability in index
ghsa_unreviewed·2022-05-01·CVSS 4.3
CVE-2007-2423 [MEDIUM] GHSA-cxxq-wr83-qfr5: Cross-site scripting (XSS) vulnerability in index
Cross-site scripting (XSS) vulnerability in index.php in MoinMoin 1.5.7 allows remote attackers to inject arbitrary web script or HTML via the do parameter in an AttachFile action, a different vulnerability than CVE-2007-0857. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
OSV
CVE-2007-2423: Cross-site scripting (XSS) vulnerability in index
osv·2007-05-02·CVSS 4.3
CVE-2007-2423 [MEDIUM] CVE-2007-2423: Cross-site scripting (XSS) vulnerability in index
Cross-site scripting (XSS) vulnerability in index.php in MoinMoin 1.5.7 allows remote attackers to inject arbitrary web script or HTML via the do parameter in an AttachFile action, a different vulnerability than CVE-2007-0857. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
No detection rules found.
Bugzilla
CVE-2008-0781 MoinMoin multiple XSS in AttachFile action
bugzilla·2008-02-14·CVSS 5.8
CVE-2008-0781 [MEDIUM] CVE-2008-0781 MoinMoin multiple XSS in AttachFile action
CVE-2008-0781 MoinMoin multiple XSS in AttachFile action
Description of problem:
The following fix was commited to 1.5 branch in upstream repository:
http://hg.moinmo.in/moin/1.5/rev/db212dfc58ef
"fix XSS issues in AttachFile action"
Discussion:
CVE name was requested.
Note that this issue is different from CVE-2007-2423 [1]
[1] http://hg.moinmo.in/moin/1.5/rev/288694f8dfde
---
Ping on this. Matthias do you need help updating the package?
---
moin-1.5.8-4.fc8 has been submitted as an update for Fedora 8
---
moin-1.5.8-4.fc7 has been submitted as an update for Fedora 7
---
moin-1.5.8-4.fc7 has been pushed to the Fedora 7 stable repository. If problems still persist, please make note of it in this bug report.
---
moin-1.5.8-4.fc8 has been pushed to the Fedora 8 stable reposit
Bugzilla
CVE-2007-2423: moin <= 1.5.7 XSS
bugzilla·2007-05-02·CVSS 4.3
CVE-2007-2423 [MEDIUM] CVE-2007-2423: moin <= 1.5.7 XSS
CVE-2007-2423: moin <= 1.5.7 XSS
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2423
"Cross-site scripting (XSS) vulnerability in index.php in MoinMoin 1.5.7 allows
remote attackers to inject arbitrary web script or HTML via the do parameter in
an AttachFile action, a different vulnerability than CVE-2007-0857."
Discussion:
And once again, no patch to be found anywhere... not to mention half the reports
mentionning "PHP" or "index.php" vulnerability... *sigh*
---
Debian has a really great MoinMoin package, and seems to track upstream really
closely.
I've reviewed, included and tested 4 security patches from Debian, which should
fix CVE-2007-0857, CVE-2007-0901, CVE-2007-0902 and CVE-2007-2423 (and other
security bugs too).
I've updated F7,6,5 and EL5,4 branches (all current).
Bugzilla
CVE-2007-0901, CVE-2007-0902: moin 1.5.7 XSS, information disclosure
bugzilla·2007-02-14·CVSS 4.3
CVE-2007-0901 [MEDIUM] CVE-2007-0901, CVE-2007-0902: moin 1.5.7 XSS, information disclosure
CVE-2007-0901, CVE-2007-0902: moin 1.5.7 XSS, information disclosure
CVE's against moin 1.5.7, with little useful information available at the moment:
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-0901
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-0902
Discussion:
Looks like Ubuntu has released updates to fix these vulnerabilities. I wish the
MoinMoin website would actually publish some kind of official announcement (and
patch!), instead of having to hunt for details and a fix...
---
Still unpatched upstream, and still no patches or even details in the various
vulnerability reports... are there _any_ details about these!?
---
Debian has a really great MoinMoin package, and seems to track upstream really
closely.
I've reviewed, included and tested 4 security patches from Debian, whic
http://osvdb.org/36567http://secunia.com/advisories/29262http://www.debian.org/security/2008/dsa-1514http://www.securityfocus.com/bid/23676http://www.securityfocus.com/data/vulnerabilities/exploits/23676.htmlhttp://osvdb.org/36567http://secunia.com/advisories/29262http://www.debian.org/security/2008/dsa-1514http://www.securityfocus.com/bid/23676http://www.securityfocus.com/data/vulnerabilities/exploits/23676.html
2007-05-02
Published