MoinMoin Multiple Cross-Site Scripting Vulnerabilities Fixed by 1.9.9
Description
(#Several cross-site scripting vulnerabilities were reported in MoinMoin.#A remote attacker could exploit them by enticing their victim into following a specially crafted link in order to execute arbitrary JavaScript or HTML code.##Further information for these vulnerabilities:#- CVE-2016-7148: stored cross-site scripting in the page named which is echoed in the attach file page without encoding (parameter "action=AttachFile")##- CVE-2016-7146: stored cross-site scripting in file attachment action in the GUI editor (parameters "action=fckdialog&dialog=attachment" or via the GUI editor "Edit (GUI)" -> "Attachment")##- CVE-2016-9119: cross-site scripting in GUI editor's link dialogue.##Proofs of concept are available for the CVE-2016-7146 and CVE-2016-7148 vulnerabilities.##Updated, 15/11/2016:#The moin packages provided by Debian Wheezy 7 are vulnerable.#Updated, 09/01/2017:#The moinmoin packages provided by FreeBSD are vulnerable.)
