CVE-2016-7148

Advisory

Moin 1.9.9 includes a fix for CVE-2016-7148: MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation" approach, related to a "Cross Site Scripting (XSS)" issue affecting the action=AttachFile (via page name) component.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Fixes:
* security: fix XSS in AttachFile view (multifile related) CVE-2016-7148
* security: fix XSS in GUI editor's attachment dialogue CVE-2016-7146
* security: fix XSS in GUI editor's link dialogue CVE-2016-9119
* catch IOError for zipfile errors (sometimes triggered by zipfile.is_zipfile
false positives, see http://bugs.python.org/issue28494 ).

Other changes:
* update moin.spec, setup.py: py27 only

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7148
• https://www.curesec.com/blog/article/blog/MoinMoin-198-XSS-175.html
• http://www.securityfocus.com/bid/94259
• http://www.ubuntu.com/usn/USN-3137-1
• http://www.debian.org/security/2016/dsa-3715