CVE-2016-7148

Name	CVE-2016-7148
Description	MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation" approach, related to a "Cross Site Scripting (XSS)" issue affecting the action=AttachFile (via page name) component.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-3715-1
Debian Bugs	844341

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
moin	source	wheezy	(not affected)
moin	source	jessie	1.9.8-1+deb8u1	DSA-3715-1
moin	source	(unstable)	1.9.9-1		844341

Notes

[wheezy] - moin <not-affected> (vulnerable code not present)
Fixed by: http://hg.moinmo.in/moin/1.9/rev/eceb70c41ecc
https://www.curesec.com/blog/article/blog/MoinMoin-198-XSS-175.html