Vulnerability Details : CVE-2010-2970
Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/SlideShow.py, (2) action/anywikidraw.py, and (3) action/language_setup.py, a similar issue to CVE-2010-2487.
Vulnerability category: Cross site scripting (XSS)
Exploit prediction scoring system (EPSS) score for CVE-2010-2970
Probability of exploitation activity in the next 30 days: 0.23%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 60 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2010-2970
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2010-2970
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2010-2970
-
http://hg.moinmo.in/moin/1.9/rev/e50b087c4572
moin/1.9: e50b087c4572
-
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809
#584809 - CVE-2010-2487: multiple XSS vulnerabilities in moin - Debian Bug report logs
-
http://www.debian.org/security/2010/dsa-2083
Debian -- Security Information -- DSA-2083-1 moin
-
http://moinmo.in/SecurityFixes
SecurityFixes - MoinMoinVendor Advisory
-
http://marc.info/?l=oss-security&m=127809682420259&w=2
'Re: [oss-security] CVE request: moin multiple XSS' - MARC
-
http://hg.moinmo.in/moin/1.9/rev/4fe9951788cb
moin/1.9: 4fe9951788cb
-
http://marc.info/?l=oss-security&m=127799369406968&w=2
'[oss-security] CVE request: moin multiple XSS' - MARC
-
http://www.vupen.com/english/advisories/2010/1981
Webmail | OVH- OVHVendor Advisory
-
http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg
MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg - MoinMoinVendor Advisory
-
http://moinmo.in/MoinMoinRelease1.9
MoinMoinRelease1.9 - MoinMoin
- http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES
-
http://www.securityfocus.com/bid/40549
MoinMoin 'PageEditor.py' Cross-Site Scripting Vulnerability
Products affected by CVE-2010-2970
- cpe:2.3:a:moinmo:moinmoin:1.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:moinmo:moinmoin:1.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:moinmo:moinmoin:1.9.2:*:*:*:*:*:*:*