CVE-2010-2970 - Vulnerability Details - OpenCVE

Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/SlideShow.py, (2) action/anywikidraw.py, and (3) action/language_setup.py, a similar issue to CVE-2010-2487.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Moinmo	Moinmoin

Configuration 1 [-]

OR	cpe:2.3:a:moinmo:moinmoin:1.9.0:::::::*
	cpe:2.3:a:moinmo:moinmoin:1.9.1:::::::*
	cpe:2.3:a:moinmo:moinmoin:1.9.2:::::::*

No data.

References

Link	Providers
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809
http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES
http://hg.moinmo.in/moin/1.9/rev/4fe9951788cb
http://hg.moinmo.in/moin/1.9/rev/e50b087c4572
http://marc.info/?l=oss-security&m=127799369406968&w=2
http://marc.info/?l=oss-security&m=127809682420259&w=2
http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg
http://moinmo.in/MoinMoinRelease1.9
http://moinmo.in/SecurityFixes
http://secunia.com/advisories/40836
http://www.debian.org/security/2010/dsa-2083
http://www.securityfocus.com/bid/40549
http://www.vupen.com/english/advisories/2010/1981

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2010-08-04T21:00:00Z

Updated: 2024-09-17T00:16:31.838Z

Reserved: 2010-08-04T00:00:00Z

Link: CVE-2010-2970

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2010-08-05T13:22:29.950

Modified: 2025-04-11T00:51:21.963

Link: CVE-2010-2970

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/SlideShow.py, (2) action/anywikidraw.py, and (3) action/language_setup.py, a similar issue to CVE-2010-2487."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2010-08-04T21:00:00Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "ADV-2010-1981", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2010/1981"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://moinmo.in/MoinMoinRelease1.9"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://moinmo.in/SecurityFixes"}, {"name": "40549", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/40549"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://hg.moinmo.in/moin/1.9/rev/4fe9951788cb"}, {"name": "DSA-2083", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2010/dsa-2083"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://hg.moinmo.in/moin/1.9/rev/e50b087c4572"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809"}, {"name": "[oss-security] 20100701 CVE request: moin multiple XSS", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://marc.info/?l=oss-security&m=127799369406968&w=2"}, {"name": "[oss-security] 20100702 Re: CVE request: moin multiple XSS", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://marc.info/?l=oss-security&m=127809682420259&w=2"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES"}, {"name": "40836", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/40836"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2010-2970", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/SlideShow.py, (2) action/anywikidraw.py, and (3) action/language_setup.py, a similar issue to CVE-2010-2487."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "ADV-2010-1981", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2010/1981"}, {"name": "http://moinmo.in/MoinMoinRelease1.9", "refsource": "CONFIRM", "url": "http://moinmo.in/MoinMoinRelease1.9"}, {"name": "http://moinmo.in/SecurityFixes", "refsource": "CONFIRM", "url": "http://moinmo.in/SecurityFixes"}, {"name": "40549", "refsource": "BID", "url": "http://www.securityfocus.com/bid/40549"}, {"name": "http://hg.moinmo.in/moin/1.9/rev/4fe9951788cb", "refsource": "CONFIRM", "url": "http://hg.moinmo.in/moin/1.9/rev/4fe9951788cb"}, {"name": "DSA-2083", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2010/dsa-2083"}, {"name": "http://hg.moinmo.in/moin/1.9/rev/e50b087c4572", "refsource": "CONFIRM", "url": "http://hg.moinmo.in/moin/1.9/rev/e50b087c4572"}, {"name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809", "refsource": "CONFIRM", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809"}, {"name": "[oss-security] 20100701 CVE request: moin multiple XSS", "refsource": "MLIST", "url": "http://marc.info/?l=oss-security&m=127799369406968&w=2"}, {"name": "[oss-security] 20100702 Re: CVE request: moin multiple XSS", "refsource": "MLIST", "url": "http://marc.info/?l=oss-security&m=127809682420259&w=2"}, {"name": "http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES", "refsource": "CONFIRM", "url": "http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES"}, {"name": "40836", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/40836"}, {"name": "http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg", "refsource": "CONFIRM", "url": "http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T02:55:45.501Z"}, "title": "CVE Program Container", "references": [{"name": "ADV-2010-1981", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2010/1981"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://moinmo.in/MoinMoinRelease1.9"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://moinmo.in/SecurityFixes"}, {"name": "40549", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/40549"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://hg.moinmo.in/moin/1.9/rev/4fe9951788cb"}, {"name": "DSA-2083", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2010/dsa-2083"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://hg.moinmo.in/moin/1.9/rev/e50b087c4572"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809"}, {"name": "[oss-security] 20100701 CVE request: moin multiple XSS", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://marc.info/?l=oss-security&m=127799369406968&w=2"}, {"name": "[oss-security] 20100702 Re: CVE request: moin multiple XSS", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://marc.info/?l=oss-security&m=127809682420259&w=2"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES"}, {"name": "40836", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/40836"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2010-2970", "datePublished": "2010-08-04T21:00:00Z", "dateReserved": "2010-08-04T00:00:00Z", "dateUpdated": "2024-09-17T00:16:31.838Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:moinmo:moinmoin:1.9.0:*:*:*:*:*:*:*", "matchCriteriaId": "BAA73028-4193-49E9-B017-F1F27075FDDE", "vulnerable": true}, {"criteria": "cpe:2.3:a:moinmo:moinmoin:1.9.1:*:*:*:*:*:*:*", "matchCriteriaId": "2B6FF2CB-A7F2-4E74-8B95-0C7BA3DE47AD", "vulnerable": true}, {"criteria": "cpe:2.3:a:moinmo:moinmoin:1.9.2:*:*:*:*:*:*:*", "matchCriteriaId": "1B7C3A9E-1655-436F-94FF-390D44926A28", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/SlideShow.py, (2) action/anywikidraw.py, and (3) action/language_setup.py, a similar issue to CVE-2010-2487."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en MoinMoin v1.9.x anterior v1.9.3 permite a atacantes remotos inyectar c\u00f3digo web o HTML de su elecci\u00f3n a trav\u00e9 de contenido manipulado, relacionado con (1) action/SlideShow.py, (2) action/anywikidraw.py, y (3) action/language_setup.py, un tema similar a CVE-2010-2487."}], "id": "CVE-2010-2970", "lastModified": "2025-04-11T00:51:21.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2010-08-05T13:22:29.950", "references": [{"source": "cve@mitre.org", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809"}, {"source": "cve@mitre.org", "url": "http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES"}, {"source": "cve@mitre.org", "url": "http://hg.moinmo.in/moin/1.9/rev/4fe9951788cb"}, {"source": "cve@mitre.org", "url": "http://hg.moinmo.in/moin/1.9/rev/e50b087c4572"}, {"source": "cve@mitre.org", "url": "http://marc.info/?l=oss-security&m=127799369406968&w=2"}, {"source": "cve@mitre.org", "url": "http://marc.info/?l=oss-security&m=127809682420259&w=2"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg"}, {"source": "cve@mitre.org", "url": "http://moinmo.in/MoinMoinRelease1.9"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://moinmo.in/SecurityFixes"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/40836"}, {"source": "cve@mitre.org", "url": "http://www.debian.org/security/2010/dsa-2083"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/40549"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2010/1981"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://hg.moinmo.in/moin/1.9/rev/4fe9951788cb"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://hg.moinmo.in/moin/1.9/rev/e50b087c4572"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://marc.info/?l=oss-security&m=127799369406968&w=2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://marc.info/?l=oss-security&m=127809682420259&w=2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://moinmo.in/MoinMoinRelease1.9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://moinmo.in/SecurityFixes"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/40836"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2010/dsa-2083"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/40549"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2010/1981"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}