Upstream information

CVE-2020-15275 at MITRE

Description

MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrade to a patched version. MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v2 Scores
  National Vulnerability Database
Base Score 3.5
Vector AV:N/AC:M/Au:S/C:N/I:P/A:N
Access Vector Network
Access Complexity Medium
Authentication Single
Confidentiality Impact None
Integrity Impact Partial
Availability Impact None
CVSS v3 Scores
  National Vulnerability Database
Base Score 5.4
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Changed
Confidentiality Impact Low
Integrity Impact Low
Availability Impact None
CVSSv3 Version 3.1
SUSE Bugzilla entry: 1178745 [NEW]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Package Hub 15 SP2
  • moinmoin-wiki >= 1.9.11-bp152.4.3.1
 Patchnames:
openSUSE-2020-1998
openSUSE Leap 15.2
  • moinmoin-wiki >= 1.9.11-lp152.3.3.1
 Patchnames:
openSUSE-2020-1966

SUSE Timeline for this CVE

CVE page created: Mon Nov 9 21:59:22 2020
CVE page last modified: Tue May 23 15:34:28 2023