Security readout for executives and security teams
Plain-English summary
MoinMoin wiki versions before 1.9.11 can let a user with page write access upload a malicious SVG attachment. If another user opens that SVG in the wiki, browser-based script can run under the wiki site context, risking account data and unauthorized actions.
Executive priority
Treat this as a near-term remediation item for any active MoinMoin 1.9 wiki. It is not marked as actively exploited in the provided evidence, but the impact is high because a normal content contributor can plant browser-executed code for later victims.
Technical view
This is a stored cross-site scripting issue, CWE-79, in MoinMoin 1.9 before 1.9.11. The advisory describes malicious JavaScript embedded in an uploaded SVG attachment. Exploitation requires authenticated write permission and victim interaction by viewing the SVG. CVSS 3.1 is 8.7 with changed scope and high confidentiality and integrity impact.
Likely exposure
Exposure is most likely in organizations still running MoinMoin 1.9 before 1.9.11, especially internal wikis where contributors can upload attachments. Internet exposure increases impact, but the provided sources do not say whether typical deployments are public or private.
Exploitation context
The provided bundle does not show CISA KEV listing or active exploitation evidence. A successful attack needs a contributor-level attacker and a user who views the malicious SVG attachment. Impact centers on browser-session compromise within the wiki context, not direct server code execution.
Researcher notes
The key boundary is attachment content handling: SVG JavaScript executes when viewed through the wiki. The sources identify the fixed release and related commit, but the prompt bundle does not provide enough detail to validate exact sanitization mechanics without reviewing the patch.
Mitigation direction
- Upgrade affected MoinMoin 1.9 installations to version 1.9.11 or later.
- Review the GitHub advisory and 1.9.11 release notes before rollout.
- Prioritize wikis where untrusted or broad contributor groups can upload attachments.
- If upgrade is delayed, check vendor guidance for safe interim attachment-handling controls.
Validation and detection
- Inventory MoinMoin instances and confirm installed versions are 1.9.11 or later.
- Review wiki attachment permissions for users or groups with write access.
- Search for existing SVG attachments uploaded by lower-trust contributors.
- Confirm security testing covers attachment rendering behavior after upgrade.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-15275 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N2.35.8Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.7HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/moinwiki/moin-1.9/security/advisories/GHSA-4q96-6xhq-ff43CVE reference · x_refsource_CONFIRM
- https://github.com/moinwiki/moin-1.9/releases/tag/1.9.11CVE reference · x_refsource_MISC
- https://github.com/moinwiki/moin-1.9/commit/31de9139d0aabc171e94032168399b4a0b2a88a2CVE reference · x_refsource_MISC
- https://advisory.checkmarx.net/advisory/CX-2020-4285CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.