FKIE_CVE-2008-1098

Vulnerability from fkie_nvd - Published: 2008-03-05 20:44 - Updated: 2026-06-16 22:50
Severity
Summary
Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.5.8 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) certain input processed by formatter/text_gedit.py (aka the gui editor formatter); (2) a page name, which triggers an injection in PageEditor.py when the page is successfully deleted by a victim in a DeletePage action; or (3) the destination page name for a RenamePage action, which triggers an injection in PageEditor.py when a victim's rename attempt fails because of a duplicate name. NOTE: the AttachFile XSS issue is already covered by CVE-2008-0781, and the login XSS issue is already covered by CVE-2008-0780.
References
cve@mitre.orghttp://hg.moinmo.in/moin/1.5/rev/4ede07e792ddExploit
cve@mitre.orghttp://hg.moinmo.in/moin/1.5/rev/d0152eeb4499
cve@mitre.orghttp://moinmo.in/SecurityFixes
cve@mitre.orghttp://secunia.com/advisories/29262
cve@mitre.orghttp://secunia.com/advisories/29444
cve@mitre.orghttp://secunia.com/advisories/30031
cve@mitre.orghttp://secunia.com/advisories/33755
cve@mitre.orghttp://www.debian.org/security/2008/dsa-1514
cve@mitre.orghttp://www.gentoo.org/security/en/glsa/glsa-200803-27.xml
cve@mitre.orghttp://www.securityfocus.com/bid/28173
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/41037
cve@mitre.orghttps://usn.ubuntu.com/716-1/
cve@mitre.orghttps://www.redhat.com/archives/fedora-package-announce/2008-April/msg00510.html
cve@mitre.orghttps://www.redhat.com/archives/fedora-package-announce/2008-April/msg00538.html
af854a3a-2127-422b-91ae-364da2661108http://hg.moinmo.in/moin/1.5/rev/4ede07e792ddExploit
af854a3a-2127-422b-91ae-364da2661108http://hg.moinmo.in/moin/1.5/rev/d0152eeb4499
af854a3a-2127-422b-91ae-364da2661108http://moinmo.in/SecurityFixes
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/29262
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/29444
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/30031
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/33755
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2008/dsa-1514
af854a3a-2127-422b-91ae-364da2661108http://www.gentoo.org/security/en/glsa/glsa-200803-27.xml
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/28173
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/41037
af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/716-1/
af854a3a-2127-422b-91ae-364da2661108https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00510.html
af854a3a-2127-422b-91ae-364da2661108https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00538.html
Impacted products
Vendor Product Version
moinmoin moinmoin *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C3A2FDB5-6C57-43E2-AA1B-D083D93C5679",
              "versionEndIncluding": "1.5.8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.5.8 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) certain input processed by formatter/text_gedit.py (aka the gui editor formatter); (2) a page name, which triggers an injection in PageEditor.py when the page is successfully deleted by a victim in a DeletePage action; or (3) the destination page name for a RenamePage action, which triggers an injection in PageEditor.py when a victim\u0027s rename attempt fails because of a duplicate name.  NOTE: the AttachFile XSS issue is already covered by CVE-2008-0781, and the login XSS issue is already covered by CVE-2008-0780."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en MoinMoin 1.5.8 y anteriores permiten a atacantes remotos   inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de (1) ciertas entradas procesadas por formatter/text_gedit.py (tambi\u00e9n conocido como el gui editor formatter); (2) un  nombre de p\u00e1gina, que dispara una inyecci\u00f3n en PageEditor.py cuando la p\u00e1gina se borra exitosamente por una v\u00edctima en una acci\u00f3n DeletePage; (3) el nombre de la p\u00e1gina destino para una acci\u00f3n RenamePage, lo que dispara una inyecci\u00f3n en PageEditor.py cuando un intento de cambiar el nombre de la v\u00edctima falla debido a un nombre duplicado."
    }
  ],
  "id": "CVE-2008-1098",
  "lastModified": "2026-06-16T22:50:59.290",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2008-03-05T20:44:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://hg.moinmo.in/moin/1.5/rev/4ede07e792dd"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://hg.moinmo.in/moin/1.5/rev/d0152eeb4499"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://moinmo.in/SecurityFixes"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/29262"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/29444"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/30031"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/33755"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2008/dsa-1514"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200803-27.xml"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/28173"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41037"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://usn.ubuntu.com/716-1/"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00510.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00538.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://hg.moinmo.in/moin/1.5/rev/4ede07e792dd"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://hg.moinmo.in/moin/1.5/rev/d0152eeb4499"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://moinmo.in/SecurityFixes"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/29262"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/29444"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/30031"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/33755"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2008/dsa-1514"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200803-27.xml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/28173"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41037"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://usn.ubuntu.com/716-1/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00510.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00538.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.