Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-f66h-6mj2-rwj2
Advisory ID github_osv/GHSA-f66h-6mj2-rwj2
Aliases CVE-2014-3548
Summary Moodle multiple cross-site scripting (XSS) vulnerabilities Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via vectors that trigger an AJAX exception dialog.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
System Score Found at
generic_textual MODERATE
Reference id Reference type URL
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45471
http://openwall.com/lists/oss-security/2014/07/21/1
https://github.com/moodle/moodle
https://github.com/moodle/moodle/commit/166e18d7cbb36d58d08a2783edd98284d5a3b98a
https://github.com/moodle/moodle/commit/53ca351f7af8d80a0ff0aba27a1c278fb731d288
https://github.com/moodle/moodle/commit/6eb787b873f5d3718dc8a74f798ee528d600d8fe
https://github.com/moodle/moodle/commit/a1ae35173b54ed0c2c3736dfa78cad9899a55d4e
https://moodle.org/mod/forum/discuss.php?d=264270
https://web.archive.org/web/20200228161543/http://www.securityfocus.com/bid/68766
CVE-2014-3548 https://nvd.nist.gov/vuln/detail/CVE-2014-3548
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.