CVE-2020-15275CWE-79

malicious SVG attachment causing stored XSS vulnerability in MoinMoin

High · published November 11, 2020

CVSS v3.1
8.7
EPSS
2%
Percentile
77.6
In the wild
Unconfirmed
What it is

MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrade to a patched version. MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01746 · 77.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2020-11-11T15:45Z
EPSS history
Timeline
  • 11 NOV 15:45Z
    malicious SVG attachment causing stored XSS vulnerability in MoinMoin
    cvelistv5