Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-hwjv-mc78-cccj
Advisory ID github_osv/GHSA-hwjv-mc78-cccj
Aliases CVE-2014-3547
Summary Moodle multiple cross-site scripting (XSS) vulnerabilities Multiple cross-site scripting (XSS) vulnerabilities in badges/renderer.php in Moodle 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via an external badge.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
System Score Found at
generic_textual MODERATE
Reference id Reference type URL
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-46042
http://openwall.com/lists/oss-security/2014/07/21/1
https://github.com/moodle/moodle
https://github.com/moodle/moodle/commit/0174a0a57f6d84e240dd0bc0df0ffa63c3cc5a88
https://github.com/moodle/moodle/commit/200a2b7fad3f7ef92b3171a07d68df6958d842b7
https://github.com/moodle/moodle/commit/9eef6b5237520f0cb9874564e577c64e3a831987
https://github.com/moodle/moodle/commit/ea76b652fc4f3600403a61e54f198cc8570a4234
https://moodle.org/mod/forum/discuss.php?d=264269
http://www.securityfocus.com/bid/68758
CVE-2014-3547 https://nvd.nist.gov/vuln/detail/CVE-2014-3547
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.