MoinMoin 'refuri' Cross-Site Scripting Vulnerability

Bugtraq ID:	46476
Class:	Input Validation Error
CVE:	CVE-2011-1058
Remote:	Yes
Local:	No
Published:	Feb 21 2011 12:00AM
Updated:	Apr 13 2015 09:33PM
Credit:	Reported by the vendor.
Vulnerable:	Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 11.10 i386 Ubuntu Ubuntu Linux 11.10 amd64 Ubuntu Ubuntu Linux 11.04 powerpc Ubuntu Ubuntu Linux 11.04 i386 Ubuntu Ubuntu Linux 11.04 ARM Ubuntu Ubuntu Linux 11.04 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 MoinMoin MoinMoin 1.9.3 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

MoinMoin 'refuri' Cross-Site Scripting Vulnerability

MoinMoin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

MoinMoin 1.9.3 is vulnerable; prior versions may also be affected.

MoinMoin 'refuri' Cross-Site Scripting Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to follow a malicious URI.

MoinMoin 'refuri' Cross-Site Scripting Vulnerability

Solution:
The vendor has fixed the issue in the repository. Please see the references for more information.