oss-security - CVE request: MoinMoin Wiki (XSS in rss link)

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Sat, 29 Dec 2012 15:37:34 +0100
From: Tilmann Haak <tilmann.haak@....de>
To: oss-security@...ts.openwall.com
Subject: CVE request: MoinMoin Wiki (XSS in rss link)

Hi all,

there is an XSS issue in MoinMoin wiki, version 1.9.5. Function
rsslink() in "theme/__init__.py" does not properly escape the page name
parameter.

Details can be found at: http://moinmo.in/SecurityFixes

A fix is available at: http://hg.moinmo.in/moin/1.9/rev/c98ec456e493

Could you please assign a CVE number?

kind regards,
   Tilmann

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.