{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/43448?format=json","vulnerability_id":"VCID-s5cy-eva4-wbaf","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nMultiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) qualification or (2) rating field in a rubric.","aliases":[{"alias":"CVE-2014-3551"},{"alias":"GHSA-m8f5-9wg8-2c3h"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62209?format=json","purl":"pkg:composer/moodle/moodle@2.4.11","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/moodle/moodle@2.4.11"},{"url":"http://public2.vulnerablecode.io/api/packages/62059?format=json","purl":"pkg:composer/moodle/moodle@2.5.7","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/moodle/moodle@2.5.7"},{"url":"http://public2.vulnerablecode.io/api/packages/62060?format=json","purl":"pkg:composer/moodle/moodle@2.6.4","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/moodle/moodle@2.6.4"},{"url":"http://public2.vulnerablecode.io/api/packages/62061?format=json","purl":"pkg:composer/moodle/moodle@2.7.1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/moodle/moodle@2.7.1"}],"affected_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62041?format=json","purl":"pkg:composer/moodle/moodle@2.5.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1ehh-qz6c-ykhp"},{"vulnerability":"VCID-1whm-dsv7-t7gm"},{"vulnerability":"VCID-4v57-bu85-syhr"},{"vulnerability":"VCID-4xqt-yugc-qufr"},{"vulnerability":"VCID-5ru2-1n1f-afa4"},{"vulnerability":"VCID-6v43-drd7-ufd7"},{"vulnerability":"VCID-7g7m-bu5q-gbcx"},{"vulnerability":"VCID-88pw-zwqn-cqfd"},{"vulnerability":"VCID-cvqm-kjhx-q7ej"},{"vulnerability":"VCID-czph-uxwr-5uge"},{"vulnerability":"VCID-ea5s-xphb-6ub7"},{"vulnerability":"VCID-gdz8-d8j3-nqdh"},{"vulnerability":"VCID-h8xn-n98n-qqdv"},{"vulnerability":"VCID-j3t3-svwb-p7bn"},{"vulnerability":"VCID-q3wv-9hj6-vbgt"},{"vulnerability":"VCID-qpu2-8paz-7ydv"},{"vulnerability":"VCID-qxyw-7hnt-hqd6"},{"vulnerability":"VCID-r88h-mteg-yka9"},{"vulnerability":"VCID-rdfn-52p2-afa7"},{"vulnerability":"VCID-s5cy-eva4-wbaf"},{"vulnerability":"VCID-ucg8-htfc-2bhn"},{"vulnerability":"VCID-vrfy-36yc-muhr"},{"vulnerability":"VCID-vs2j-b4qg-nbgu"},{"vulnerability":"VCID-vwyj-z4gf-8fg5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/moodle/moodle@2.5.0"},{"url":"http://public2.vulnerablecode.io/api/packages/62042?format=json","purl":"pkg:composer/moodle/moodle@2.6.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1ehh-qz6c-ykhp"},{"vulnerability":"VCID-1rar-m2g3-27ag"},{"vulnerability":"VCID-1whm-dsv7-t7gm"},{"vulnerability":"VCID-29yj-e9bd-queq"},{"vulnerability":"VCID-3xwm-hqap-8bct"},{"vulnerability":"VCID-4v57-bu85-syhr"},{"vulnerability":"VCID-4xqt-yugc-qufr"},{"vulnerability":"VCID-5c29-qn3p-3yde"},{"vulnerability":"VCID-5ru2-1n1f-afa4"},{"vulnerability":"VCID-6v43-drd7-ufd7"},{"vulnerability":"VCID-7g7m-bu5q-gbcx"},{"vulnerability":"VCID-7x8g-tdd5-kqbs"},{"vulnerability":"VCID-88pw-zwqn-cqfd"},{"vulnerability":"VCID-8q4n-d565-kfbn"},{"vulnerability":"VCID-bfmx-cwap-8yhp"},{"vulnerability":"VCID-cvqm-kjhx-q7ej"},{"vulnerability":"VCID-czph-uxwr-5uge"},{"vulnerability":"VCID-ea5s-xphb-6ub7"},{"vulnerability":"VCID-fs9k-21es-rygd"},{"vulnerability":"VCID-fumj-9pun-zfc5"},{"vulnerability":"VCID-gdz8-d8j3-nqdh"},{"vulnerability":"VCID-h8xn-n98n-qqdv"},{"vulnerability":"VCID-hbky-xx53-vkct"},{"vulnerability":"VCID-hck4-emsr-q7dc"},{"vulnerability":"VCID-j3t3-svwb-p7bn"},{"vulnerability":"VCID-krn6-pwk5-ake2"},{"vulnerability":"VCID-kzwd-2e6n-fkbm"},{"vulnerability":"VCID-q3wv-9hj6-vbgt"},{"vulnerability":"VCID-qpu2-8paz-7ydv"},{"vulnerability":"VCID-qxyw-7hnt-hqd6"},{"vulnerability":"VCID-r88h-mteg-yka9"},{"vulnerability":"VCID-rdfn-52p2-afa7"},{"vulnerability":"VCID-s5cy-eva4-wbaf"},{"vulnerability":"VCID-ucg8-htfc-2bhn"},{"vulnerability":"VCID-uptz-tj66-7yfk"},{"vulnerability":"VCID-uvgt-7m5a-xkdc"},{"vulnerability":"VCID-v4qm-48kk-pfaz"},{"vulnerability":"VCID-v7zm-cw8w-6yf8"},{"vulnerability":"VCID-vda3-4fgr-gfbw"},{"vulnerability":"VCID-vrfy-36yc-muhr"},{"vulnerability":"VCID-vs2j-b4qg-nbgu"},{"vulnerability":"VCID-vwyj-z4gf-8fg5"},{"vulnerability":"VCID-xnmk-jah2-ufce"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/moodle/moodle@2.6.0"},{"url":"http://public2.vulnerablecode.io/api/packages/52560?format=json","purl":"pkg:composer/moodle/moodle@2.7.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1ehh-qz6c-ykhp"},{"vulnerability":"VCID-1rar-m2g3-27ag"},{"vulnerability":"VCID-1z6j-fs6f-eua1"},{"vulnerability":"VCID-29yj-e9bd-queq"},{"vulnerability":"VCID-2dxb-v1af-jbax"},{"vulnerability":"VCID-2y3m-yuaj-vkf2"},{"vulnerability":"VCID-37j1-ym2f-1fbc"},{"vulnerability":"VCID-37pj-u3gh-n7fd"},{"vulnerability":"VCID-3xwm-hqap-8bct"},{"vulnerability":"VCID-46jw-xjbu-b3f1"},{"vulnerability":"VCID-4cx7-eaax-8uhr"},{"vulnerability":"VCID-4kq5-ctsv-eka8"},{"vulnerability":"VCID-5c29-qn3p-3yde"},{"vulnerability":"VCID-5nfq-4syg-87da"},{"vulnerability":"VCID-5rbf-4dz3-2qdz"},{"vulnerability":"VCID-5vx4-qtb2-fqe9"},{"vulnerability":"VCID-62yh-cpfr-9bb1"},{"vulnerability":"VCID-8cc1-hbzm-87bx"},{"vulnerability":"VCID-8q4n-d565-kfbn"},{"vulnerability":"VCID-95mq-m2jz-a3ab"},{"vulnerability":"VCID-9z66-z9af-17f7"},{"vulnerability":"VCID-a3pu-x51u-1udr"},{"vulnerability":"VCID-an53-nu91-k3d7"},{"vulnerability":"VCID-aqc8-tmeg-9fdd"},{"vulnerability":"VCID-b9ej-hx7z-1bb8"},{"vulnerability":"VCID-bfmx-cwap-8yhp"},{"vulnerability":"VCID-czph-uxwr-5uge"},{"vulnerability":"VCID-d3yp-gq4c-vyf8"},{"vulnerability":"VCID-dhku-uah4-ykh8"},{"vulnerability":"VCID-ea5s-xphb-6ub7"},{"vulnerability":"VCID-eaqp-7abt-6kg9"},{"vulnerability":"VCID-emu7-jhv2-zqb8"},{"vulnerability":"VCID-evke-m8nn-6ua3"},{"vulnerability":"VCID-fumj-9pun-zfc5"},{"vulnerability":"VCID-g4hn-yz26-1beb"},{"vulnerability":"VCID-gvan-87dt-b7fp"},{"vulnerability":"VCID-h8xn-n98n-qqdv"},{"vulnerability":"VCID-hbky-xx53-vkct"},{"vulnerability":"VCID-hck4-emsr-q7dc"},{"vulnerability":"VCID-j11s-2mhg-pfdn"},{"vulnerability":"VCID-k6pw-51st-b3d2"},{"vulnerability":"VCID-kgvw-uxf4-wbc1"},{"vulnerability":"VCID-krn6-pwk5-ake2"},{"vulnerability":"VCID-kzwd-2e6n-fkbm"},{"vulnerability":"VCID-n9uc-b76m-8fbs"},{"vulnerability":"VCID-nfdb-m7rg-47ca"},{"vulnerability":"VCID-qxyw-7hnt-hqd6"},{"vulnerability":"VCID-r3f7-9paf-83ht"},{"vulnerability":"VCID-r88h-mteg-yka9"},{"vulnerability":"VCID-rdfn-52p2-afa7"},{"vulnerability":"VCID-rscq-xx52-2ua8"},{"vulnerability":"VCID-s3bw-w61k-eqhy"},{"vulnerability":"VCID-s3ue-e5h8-f3dy"},{"vulnerability":"VCID-s5cy-eva4-wbaf"},{"vulnerability":"VCID-tmwc-f872-mufw"},{"vulnerability":"VCID-ucg8-htfc-2bhn"},{"vulnerability":"VCID-uptz-tj66-7yfk"},{"vulnerability":"VCID-uvgt-7m5a-xkdc"},{"vulnerability":"VCID-v4qm-48kk-pfaz"},{"vulnerability":"VCID-v54t-5thx-1beu"},{"vulnerability":"VCID-v6ha-ekxw-7bfr"},{"vulnerability":"VCID-v7zm-cw8w-6yf8"},{"vulnerability":"VCID-vda3-4fgr-gfbw"},{"vulnerability":"VCID-vs2j-b4qg-nbgu"},{"vulnerability":"VCID-vtq4-fpr8-hudb"},{"vulnerability":"VCID-wavt-rrws-3yhs"},{"vulnerability":"VCID-wawr-t9dc-33fj"},{"vulnerability":"VCID-xmm4-zw49-3feh"},{"vulnerability":"VCID-xnmk-jah2-ufce"},{"vulnerability":"VCID-xy2y-yxfu-xfgm"},{"vulnerability":"VCID-y2vh-7r7h-9ugu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/moodle/moodle@2.7.0"}],"references":[{"reference_url":"http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-46223","reference_id":"","reference_type":"","scores":[],"url":"http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-46223"},{"reference_url":"http://openwall.com/lists/oss-security/2014/07/21/1","reference_id":"","reference_type":"","scores":[],"url":"http://openwall.com/lists/oss-security/2014/07/21/1"},{"reference_url":"https://github.com/moodle/moodle/commit/1f8eb0842835bcd1ea72b2d2982e0b5c8bc133bb","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/moodle/moodle/commit/1f8eb0842835bcd1ea72b2d2982e0b5c8bc133bb"},{"reference_url":"https://github.com/moodle/moodle/commit/2c0b608cda12540de79aac0ee6952dda2c8ed947","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/moodle/moodle/commit/2c0b608cda12540de79aac0ee6952dda2c8ed947"},{"reference_url":"https://github.com/moodle/moodle/commit/470a466d7f1e0aef030ad2178bbef5a81765c42e","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/moodle/moodle/commit/470a466d7f1e0aef030ad2178bbef5a81765c42e"},{"reference_url":"https://github.com/moodle/moodle/commit/4fc5861cbacdc2f4197faebd3d207d2811e0f09f","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/moodle/moodle/commit/4fc5861cbacdc2f4197faebd3d207d2811e0f09f"},{"reference_url":"https://github.com/moodle/moodle/commit/555ee08b17dfe09e02391be137f60fe38c0a7865","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/moodle/moodle/commit/555ee08b17dfe09e02391be137f60fe38c0a7865"},{"reference_url":"https://github.com/moodle/moodle/commit/666248c264642e5ca27601b347fc6913517e2853","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/moodle/moodle/commit/666248c264642e5ca27601b347fc6913517e2853"},{"reference_url":"https://github.com/moodle/moodle/commit/68299e6154ae41b7e586904fd1b860cad7f65654","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/moodle/moodle/commit/68299e6154ae41b7e586904fd1b860cad7f65654"},{"reference_url":"https://github.com/moodle/moodle/commit/72d1a3ab0b002a9a5f32f3c2b61ffc9fa7f7b789","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/moodle/moodle/commit/72d1a3ab0b002a9a5f32f3c2b61ffc9fa7f7b789"},{"reference_url":"https://github.com/moodle/moodle/commit/7f4db6f4d9014370df0265ab846ad76235af0cae","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/moodle/moodle/commit/7f4db6f4d9014370df0265ab846ad76235af0cae"},{"reference_url":"https://github.com/moodle/moodle/commit/8380722bb11f36d33308580aee169e161d3f2c14","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/moodle/moodle/commit/8380722bb11f36d33308580aee169e161d3f2c14"},{"reference_url":"https://github.com/moodle/moodle/commit/8ecc049f7f020086c1881bdf573af16cf2d9f9c9","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/moodle/moodle/commit/8ecc049f7f020086c1881bdf573af16cf2d9f9c9"},{"reference_url":"https://github.com/moodle/moodle/commit/98d5566c2270e21cbfaf1f4e8d61039f05d6aae2","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/moodle/moodle/commit/98d5566c2270e21cbfaf1f4e8d61039f05d6aae2"},{"reference_url":"https://github.com/moodle/moodle/commit/b5dacb548800ee10d4940c8ebeca48c3c2ae0512","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/moodle/moodle/commit/b5dacb548800ee10d4940c8ebeca48c3c2ae0512"},{"reference_url":"https://github.com/moodle/moodle/commit/db5a6e6560c963849f8807184ca32efee6779264","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/moodle/moodle/commit/db5a6e6560c963849f8807184ca32efee6779264"},{"reference_url":"https://github.com/moodle/moodle/commit/e42b6e20bdd5d6f09bc09be22fd7f20736e27085","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/moodle/moodle/commit/e42b6e20bdd5d6f09bc09be22fd7f20736e27085"},{"reference_url":"https://github.com/moodle/moodle/commit/eb1381de1dbcce0215dcdd62cfac4fe287beed4e","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/moodle/moodle/commit/eb1381de1dbcce0215dcdd62cfac4fe287beed4e"},{"reference_url":"https://github.com/moodle/moodle/commit/f25f472be425d6ef8aa587648dafda1bd4d1c5d8","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/moodle/moodle/commit/f25f472be425d6ef8aa587648dafda1bd4d1c5d8"},{"reference_url":"https://moodle.org/mod/forum/discuss.php?d=264273","reference_id":"","reference_type":"","scores":[],"url":"https://moodle.org/mod/forum/discuss.php?d=264273"},{"reference_url":"https://web.archive.org/web/20200228170658/http://www.securityfocus.com/bid/68763","reference_id":"","reference_type":"","scores":[],"url":"https://web.archive.org/web/20200228170658/http://www.securityfocus.com/bid/68763"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3551","reference_id":"CVE-2014-3551","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3551"},{"reference_url":"https://github.com/advisories/GHSA-m8f5-9wg8-2c3h","reference_id":"GHSA-m8f5-9wg8-2c3h","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-m8f5-9wg8-2c3h"}],"weaknesses":[{"cwe_id":1035,"name":"OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."},{"cwe_id":79,"name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."},{"cwe_id":937,"name":"OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."}],"exploits":[],"severity_range_score":null,"exploitability":null,"weighted_severity":null,"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-s5cy-eva4-wbaf"}