CVE Feed

    Dashboard / CVE / CVE-2009-0260

    CVE-2009-0260

    Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with (1) the rename parameter or (2) the drawing parameter (aka the basename variable).

    Published:Jan 23, 2009
    Last Modified:Apr 23, 2026
    EPS:Jan 23, 2009
    EPSS Score:0.03043
    CVSS Score:4.3

    Affected Products

    Vendor
    Moinmoin
    Product
    Moinmoin

    Exploits

    http://www.securityfocus.com/bid/33365http://www.securityfocus.com/bid/33365https://www.exploit-db.com/exploits/32746

    Related CVEs

    CVE-2009-1482 (CVSS 4.3) — Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin 1.8.2 and earlier allo…
    CVE-2009-0312 (CVSS 4.3) — Cross-site scripting (XSS) vulnerability in the antispam feature (security/antispam.py) in MoinMoin 1.7 and 1.…
    CVE-2008-3381 (CVSS 4.3) — Multiple cross-site scripting (XSS) vulnerabilities in macro/AdvancedSearch.py in moin (and MoinMoin) 1.6.3 an…
    CVE-2008-1937 (CVSS 6.8) — The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers lis…
    CVE-2008-1099 (CVSS 5) — _macro_Getval in wikimacro.py in MoinMoin 1.5.8 and earlier does not properly enforce ACLs, which allows remot…
    CVE-2008-1098 (CVSS 4.3) — Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.5.8 and earlier allow remote attackers to in…
    CVE-2008-0781 (CVSS 4.3) — Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin 1.5.8 and earlier allo…
    CVE-2008-0780 (CVSS 4.3) — Cross-site scripting (XSS) vulnerability in MoinMoin 1.5.x through 1.5.8 and 1.6.x before 1.6.1 allows remote …
    CVE-2008-0782 (CVSS 5) — Directory traversal vulnerability in MoinMoin 1.5.8 and earlier allows remote attackers to overwrite arbitrary…
    CVE-2007-2637 (CVSS 5) — MoinMoin before 20070507 does not properly enforce ACLs for calendars and includes, which allows remote attack…

    References

    http://hg.moinmo.in/moin/1.8/rev/8cb4d34ccbc1
    http://moinmo.in/SecurityFixes#moin1.8.1
    http://osvdb.org/51485
    http://secunia.com/advisories/33593
    http://secunia.com/advisories/33716
    http://secunia.com/advisories/33755
    http://www.securityfocus.com/archive/1/500197/100/0/threaded
    http://www.securityfocus.com/bid/33365
    http://www.vupen.com/english/advisories/2009/0195
    https://exchange.xforce.ibmcloud.com/vulnerabilities/48126
    https://usn.ubuntu.com/716-1/
    https://www.debian.org/security/2009/dsa-1715
    http://hg.moinmo.in/moin/1.8/rev/8cb4d34ccbc1
    http://moinmo.in/SecurityFixes#moin1.8.1
    http://osvdb.org/51485
    http://secunia.com/advisories/33593
    http://secunia.com/advisories/33716
    http://secunia.com/advisories/33755
    http://www.securityfocus.com/archive/1/500197/100/0/threaded
    http://www.securityfocus.com/bid/33365
    http://www.vupen.com/english/advisories/2009/0195
    https://exchange.xforce.ibmcloud.com/vulnerabilities/48126
    https://usn.ubuntu.com/716-1/
    https://www.debian.org/security/2009/dsa-1715

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High