FKIE_CVE-2009-1482

Vulnerability from fkie_nvd - Published: 2009-04-29 18:30 - Updated: 2026-06-16 23:07
Severity
Summary
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin 1.8.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) an AttachFile sub-action in the error_msg function or (2) multiple vectors related to package file errors in the upload_form function, different vectors than CVE-2009-0260.
References
cve@mitre.orghttp://hg.moinmo.in/moin/1.8/rev/5f51246a4df1Exploit
cve@mitre.orghttp://moinmo.in/SecurityFixesPatch, Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/34821Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/34945
cve@mitre.orghttp://secunia.com/advisories/35024
cve@mitre.orghttp://www.debian.org/security/2009/dsa-1791
cve@mitre.orghttp://www.securityfocus.com/bid/34631
cve@mitre.orghttp://www.ubuntu.com/usn/USN-774-1
cve@mitre.orghttp://www.vupen.com/english/advisories/2009/1119Vendor Advisory
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/50356
af854a3a-2127-422b-91ae-364da2661108http://hg.moinmo.in/moin/1.8/rev/5f51246a4df1Exploit
af854a3a-2127-422b-91ae-364da2661108http://moinmo.in/SecurityFixesPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/34821Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/34945
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/35024
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2009/dsa-1791
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/34631
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-774-1
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2009/1119Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/50356
Impacted products
Vendor Product Version
moinmo moinmoin 1.6.1
moinmoin moinmoin *
moinmoin moinmoin 0.1
moinmoin moinmoin 0.2
moinmoin moinmoin 0.3
moinmoin moinmoin 0.7
moinmoin moinmoin 0.8
moinmoin moinmoin 0.9
moinmoin moinmoin 0.10
moinmoin moinmoin 0.11
moinmoin moinmoin 1.0
moinmoin moinmoin 1.1
moinmoin moinmoin 1.2
moinmoin moinmoin 1.2.1
moinmoin moinmoin 1.2.2
moinmoin moinmoin 1.5.0
moinmoin moinmoin 1.5.1
moinmoin moinmoin 1.5.2
moinmoin moinmoin 1.5.3
moinmoin moinmoin 1.5.3_rc1
moinmoin moinmoin 1.5.3_rc2
moinmoin moinmoin 1.5.4
moinmoin moinmoin 1.5.5
moinmoin moinmoin 1.5.5_rc1
moinmoin moinmoin 1.5.5a
moinmoin moinmoin 1.5.6
moinmoin moinmoin 1.5.7
moinmoin moinmoin 1.5.8
moinmoin moinmoin 1.6
moinmoin moinmoin 1.6.0
moinmoin moinmoin 1.6.1
moinmoin moinmoin 1.6.2
moinmoin moinmoin 1.6.3
moinmoin moinmoin 1.7
moinmoin moinmoin 1.7.0
moinmoin moinmoin 1.7.1
moinmoin moinmoin 1.7.2
moinmoin moinmoin 1.7.3
moinmoin moinmoin 1.8.0
moinmoin moinmoin 1.8.1
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:moinmo:moinmoin:1.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "23A64B6E-48D4-4743-97E3-C1EC6C1A2EBE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "ACB9D53C-D2DE-4FCA-B20B-43FC0EECF9BD",
              "versionEndIncluding": "1.8.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F2D2866E-A684-4EB7-A127-5FEC934945E4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "9D41FDF8-B8BD-43D9-8D53-ADCF15F7E16B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "0BDC4AB6-39BF-4444-9CFE-B654A19814C7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "0FD78CAE-9A9D-40AA-AD1F-C124A8315714",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "8673FFE8-349E-4412-9913-1145DFA1EC46",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "24271A6D-21D9-4E8D-997F-0EC132518FBC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:0.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "B3072B82-3D5C-46DF-8869-08FAAC5C70DD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:0.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "93508FCF-7852-4CB9-AD91-AB0FCD61BE43",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "9B83ACA6-5C3C-46E3-805C-EE1E759B7331",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F7EF155-C5E0-4473-B635-C551BF3F8EFC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "ABFA7F26-835B-4454-91A2-1DBB80C53492",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C92D8510-CA34-4E6D-B432-997860C63B89",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB2354B8-9A1A-4E75-92AC-F16CFDF91761",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B44C24B-013E-4769-A200-D59752E0A041",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB8DB90E-BEE5-447E-9F78-A96634343815",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "84317439-A287-4897-9608-65095860AB95",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.5.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "2FB70477-B0F2-44D6-92A8-0F42F890CF99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.5.3_rc1:*:*:*:*:*:*:*",
              "matchCriteriaId": "013FBB75-8B01-4249-9C6C-5E27964ED2D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.5.3_rc2:*:*:*:*:*:*:*",
              "matchCriteriaId": "361C37DC-CB43-4E6A-A198-313A9D62CD18",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.5.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "22F3D66C-3D24-41D0-9E4B-BB458DD5517D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.5.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "0A4C9F85-C5EF-4991-A005-5839951B9843",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.5.5_rc1:*:*:*:*:*:*:*",
              "matchCriteriaId": "690F09A1-6195-404D-BDC3-5F02A4A201C7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.5.5a:*:*:*:*:*:*:*",
              "matchCriteriaId": "F9C82F62-DFBB-4499-8C6D-27DA49A00F6F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.5.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "57003BFE-8FB2-480A-AFA1-63817B608F9C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.5.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0FD9248-1E4B-46DC-9F78-20787F56D50B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.5.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "23539FCA-FF83-46E5-A9E2-5051D975DC12",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "10CFA717-B536-46CF-8D96-B850EB4C6F95",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "03FBCD1B-2D05-4C17-B41C-CF8DA75BB05D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "51DF4CAC-EDD8-4C71-BC77-0F516692B5FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.6.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "DB1CAAA6-8D33-4901-88E2-120AB7B4CD53",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.6.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "1F89B87E-70F6-4B3C-B684-BE2666342F74",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "77C78CF4-D4B3-4AE1-A15F-14C3BB8136D4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "33BA7179-8A11-41C1-8F54-AC9316E8330D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "59C423EE-D9F5-4570-A5E8-1AA34F05E0EB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.7.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "4B12CADC-8939-462C-8D40-DD56B13773AE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.7.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "A19C0F96-9054-4DE9-92AD-A9DAF03B4960",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "6C5CDE22-2384-4B78-A76F-B95D5FBAD141",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moinmoin:moinmoin:1.8.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E706F537-8473-4E45-9165-CA502263DC2B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin 1.8.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) an AttachFile sub-action in the error_msg function or (2) multiple vectors related to package file errors in the upload_form function, different vectors than CVE-2009-0260."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en action/AttachFile.py en MoinMoin v1.8.2 y anteriores permiten a atacantes remotos inyectar HTML o scripts web arbitrarios a trav\u00e9s de (1) una sub-acci\u00f3n AttachFile en la funci\u00f3n error_msg o (2) m\u00faltiples vectores relacionados con los errores de empaquetado de ficheros en la funci\u00f3n upload_form, diferentes vectores que CVE-2009-0260."
    }
  ],
  "id": "CVE-2009-1482",
  "lastModified": "2026-06-16T23:07:21.653",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2009-04-29T18:30:00.360",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://hg.moinmo.in/moin/1.8/rev/5f51246a4df1"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://moinmo.in/SecurityFixes"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/34821"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/34945"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/35024"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2009/dsa-1791"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/34631"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ubuntu.com/usn/USN-774-1"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1119"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50356"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://hg.moinmo.in/moin/1.8/rev/5f51246a4df1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://moinmo.in/SecurityFixes"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/34821"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/34945"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/35024"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2009/dsa-1791"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/34631"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-774-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1119"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50356"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.