Bug 498308 (CVE-2009-1482)

Summary:	CVE-2009-1482 moin: XSS in AttachFile.py
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	vpvainio
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-1482
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2009-05-03 19:00:31 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Vincent Danen 2009-04-29 19:55:59 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2009-1482 to
the following vulnerability:

Name: CVE-2009-1482
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1482
Assigned: 20090429
Reference: CONFIRM: http://hg.moinmo.in/moin/1.8/rev/5f51246a4df1
Reference: CONFIRM: http://moinmo.in/SecurityFixes
Reference: BID:34631
Reference: URL: http://www.securityfocus.com/bid/34631
Reference: SECUNIA:34821
Reference: URL: http://secunia.com/advisories/34821
Reference: VUPEN:ADV-2009-1119
Reference: URL: http://www.vupen.com/english/advisories/2009/1119

Multiple cross-site scripting (XSS) vulnerabilities in
action/AttachFile.py in MoinMoin 1.8.2 and earlier allow remote
attackers to inject arbitrary web script or HTML via (1) an AttachFile
sub-action in the error_msg function or (2) multiple vectors related
to package file errors in the upload_form function, different vectors
than CVE-2009-0260.

Comment 1 Ville-Pekka Vainio 2009-05-03 19:00:31 UTC

This has already been fixed since 20090422 in F-11 and devel and since 20090420 in F-10 and F-9, i.e. before the new CVE number even existed. The exact patch in the CVE report is here in the Fedora CVS: http://cvs.fedoraproject.org/viewvc/rpms/moin/F-11/001_CVE-2008-0781_attach_file_XSS.patch?revision=1.1&view=markup

What happened here was that I performed a sort-of security patch audit for the stable Fedora releases and Rawhide using CVE reports and Debian patches. I noticed the fix for CVE-2008-0781 had been dropped in moin 1.6 and later for some reason. I notified the upstream developers who then released the fix again for 1.7 and 1.8.

Thus I'm closing this bug. If something in this CVE report hasn't been fixed after all, feel free to reopen the report.