Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-c9jp-244j-vh78
Advisory ID github_osv/GHSA-c9jp-244j-vh78
Aliases CVE-2014-3544
Summary Moodle cross-site scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field.
Status Published
Exploitability 2.0
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
System Score Found at
generic_textual LOW
Reference id Reference type URL
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45683
http://openwall.com/lists/oss-security/2014/07/21/1
http://osandamalith.wordpress.com/2014/07/25/moodle-2-7-persistent-xss
http://osvdb.org/show/osvdb/109337
http://packetstormsecurity.com/files/127624/Moodle-2.7-Cross-Site-Scripting.html
https://github.com/moodle/moodle
https://github.com/moodle/moodle/commit/0207466e778baebff21c7b72bc688761f9c5b0d9
https://github.com/moodle/moodle/commit/739d227c58886e9a1be1426ed66053f1d37ee9a9
https://github.com/moodle/moodle/commit/ce5a785b0962c3c94c7a7b0d36176482d21db95d
https://github.com/moodle/moodle/commit/f7b6562f20f6af4119c7775477cffbaa83229f74
http://www.exploit-db.com/exploits/34169
http://www.securityfocus.com/bid/68756
CVE-2014-3544 https://nvd.nist.gov/vuln/detail/CVE-2014-3544
CVE-2014-3544;OSVDB-109337 Exploit https://moodle.org/mod/forum/discuss.php?d=264265
Data source Exploit-DB
Date added July 27, 2014
Description Moodle 2.7 - Persistent Cross-Site Scripting
Ransomware campaign use Unknown
Source publication date July 27, 2014
Exploit type webapps
Platform php
Source update date July 27, 2014
Source URL https://moodle.org/mod/forum/discuss.php?d=264265

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.