Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 allow remote attackers to inject arbitrary web script or HTML via a crafted blog link within an RSS feed.
References
| Link | Resource |
|---|---|
| http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-41623 | Vendor Advisory |
| http://packetstormsecurity.com/files/164479/Moodle-Authenticated-Spelling-Binary-Remote-Code-Execution.html | Exploit Third Party Advisory VDB Entry |
| https://moodle.org/mod/forum/discuss.php?d=238399 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
01 May 2022, 01:23
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:moodle:moodle:2.2.6:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:2.2.2:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:2.2.5:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:2.2.3:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:2.2.0:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:2.2.10:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:2.2.9:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:2.2.4:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:2.2.1:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:2.2.8:*:*:*:*:*:*:* |
|
| References | (MISC) http://packetstormsecurity.com/files/164479/Moodle-Authenticated-Spelling-Binary-Remote-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry |
12 Oct 2021, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2013-09-16 13:02
Updated : 2024-02-04 18:16
NVD link : CVE-2013-4341
Mitre link : CVE-2013-4341
CVE.ORG link : CVE-2013-4341
JSON object : View
Products Affected
moodle
- moodle
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')