CVE-2010-2970 | Vulnetix

CVE-2010-2970 PUBLISHED CVSS 6.099999904632568 MEDIUM

Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/SlideShow.py, (2) action/anywikidraw.py, and (3) action/language_setup.py, a similar issue to CVE-2010-2487.

EPSS 2.55% · 84.7th percentile

Risk Scores

CVSS 3.1

6.099999904632568

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Score

2.55%

84.7th percentile

Affected Products

Vendor	Product	Versions
moinmo	moinmoin	1.9.0, 1.9.1, 1.9.2
PyPI	Moin	1.9.0
n/a	n/a	*

Timeline

Aug 4, 2010 CVE Published
Feb 4, 2022 EPSS Score
Mar 29, 2022 EPSS Score
May 21, 2022 EPSS Score
Jul 13, 2022 EPSS Score
Sep 5, 2022 EPSS Score
Oct 28, 2022 EPSS Score
Dec 20, 2022 EPSS Score
Feb 11, 2023 EPSS Score
Apr 5, 2023 EPSS Score
May 28, 2023 EPSS Score
Jul 20, 2023 EPSS Score

References

ADV-2010-1981 vdb
http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES url
http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg url
http://hg.moinmo.in/moin/1.9/rev/e50b087c4572 url
[oss-security] 20100702 Re: CVE request: moin multiple XSS mailing-list
https://nvd.nist.gov/vuln/detail/CVE-2010-2970 advisory
https://github.com/moinwiki/moin package
https://github.com/pypa/advisory-database/tree/main/vulns/moin/PYSEC-2010-18.yaml url
https://web.archive.org/web/20140801154518/http://secunia.com/advisories/40836 url
https://web.archive.org/web/20200228150629/http://www.securityfocus.com/bid/40549 url
http://marc.info/?l=oss-security&m=127799369406968&w=2 url
http://moinmo.in/SecurityFixes advisory
http://secunia.com/advisories/40836 advisory
http://www.debian.org/security/2010/dsa-2083 technical
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809 technical
http://hg.moinmo.in/moin/1.9/rev/4fe9951788cb technical
http://moinmo.in/MoinMoinRelease1.9 technical
http://www.securityfocus.com/bid/40549 technical

Open in Interactive Console →