The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cross-site scripting (XSS) attacks via a string containing crafted URL protocols.
CVSS Details
- CVSS 3.1 Base Score: 6.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade wordpress | Jul 30, 2024 | Mar 25, 2008 |
| Gentoo Linux | — | Upgrade www-apps/egroupware. | Oct 30, 2017 | Mar 25, 2008 |
| Moodle | — | Upgrade to the latest version of Moodle | Nov 7, 2019 | Mar 25, 2008 |
| Suse | — | Upgrade moodle-kaUpgrade moodle-ukUpgrade moodle-koUpgrade moodle-faUpgrade moodle-etUpgrade moodle-srUpgrade moodle-glUpgrade moodle-viUpgrade moodle-hrUpgrade moodle-ltUpgrade moodle-plUpgrade moodle-caUpgrade suse-releaseUpgrade moodle-beUpgrade moodle-nnUpgrade moodle-arUpgrade moodle-elUpgrade moodle-heUpgrade moodle-ruUpgrade moodle-fiUpgrade moodle-svUpgrade moodle-msUpgrade moodle-bgUpgrade moodle-soUpgrade moodle-huUpgrade moodle-euUpgrade moodle-ptUpgrade moodle-thUpgrade moodle-frUpgrade moodleUpgrade moodle-jaUpgrade moodle-roUpgrade moodle-lvUpgrade moodle-afUpgrade moodle-gaUpgrade moodle-zh_cnUpgrade moodle-csUpgrade moodle-slUpgrade moodle-tlUpgrade moodle-kmUpgrade moodle-hiUpgrade moodle-skUpgrade moodle-esUpgrade moodle-de_duUpgrade moodle-bsUpgrade moodle-knUpgrade moodle-itUpgrade moodle-idUpgrade moodle-deUpgrade moodle-trUpgrade moodle-sqUpgrade moodle-daUpgrade moodle-mi_tnUpgrade moodle-isUpgrade moodle-nlUpgrade moodle-no | Feb 17, 2015 | Mar 25, 2008 |
| Ubuntu | — | Upgrade moodle | Nov 8, 2024 | Mar 25, 2008 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub