GHSA-452h-rx28-49w9

MoinMoin Cross-site scripting (XSS) vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2012-6082

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	moin	< 1.9.6	1.9.6

Details

As written in the advisory (Markdown source, shown as plain text).

Cross-site scripting (XSS) vulnerability in the rsslink function in `theme/__init__.py` in MoinMoin before 1.9.6 allows remote attackers to inject arbitrary web script or HTML via the page name in a rss link.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2012-6082 advisory
https://github.com/moinwiki/moin package
https://github.com/pypa/advisory-database/tree/main/vulns/moin/PYSEC-2013-23.yaml web
https://web.archive.org/web/20151023152540/http://secunia.com/advisories/51663 web
https://web.archive.org/web/20200228182002/http://www.securityfocus.com/bid/57089 web
http://hg.moinmo.in/moin/1.9/rev/c98ec456e493 web
http://moinmo.in/SecurityFixes web
http://www.openwall.com/lists/oss-security/2012/12/29/7 web
http://www.openwall.com/lists/oss-security/2012/12/30/5 web