Multiple cross-site scripting (XSS) vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the Login-As feature or (2) when the global search feature is enabled, unspecified global search forms in the Global Search Engine. NOTE: vector 1 might be resultant from a cross-site request forgery (CSRF) vulnerability.
CVSS Details
- CVSS 3.1 Base Score: 4.7
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Moodle | — | Upgrade to the latest version of Moodle | Dec 4, 2018 | Apr 29, 2010 |
| Suse | — | Upgrade moodle-ruUpgrade moodle-kmUpgrade moodle-plUpgrade moodle-afUpgrade moodle-esUpgrade moodleUpgrade moodle-tlUpgrade moodle-thUpgrade moodle-beUpgrade moodle-frUpgrade moodle-jaUpgrade moodle-ukUpgrade moodle-kaUpgrade moodle-bgUpgrade moodle-hrUpgrade moodle-etUpgrade moodle-skUpgrade moodle-ptUpgrade moodle-daUpgrade moodle-lvUpgrade moodle-srUpgrade moodle-arUpgrade moodle-fiUpgrade moodle-csUpgrade moodle-zh_cnUpgrade moodle-mi_tnUpgrade moodle-elUpgrade moodle-noUpgrade moodle-slUpgrade moodle-idUpgrade moodle-de_duUpgrade moodle-euUpgrade moodle-trUpgrade moodle-roUpgrade moodle-huUpgrade moodle-hiUpgrade moodle-nlUpgrade moodle-ltUpgrade moodle-knUpgrade moodle-deUpgrade moodle-soUpgrade moodle-sqUpgrade moodle-caUpgrade moodle-isUpgrade moodle-koUpgrade moodle-viUpgrade moodle-svUpgrade moodle-faUpgrade moodle-gaUpgrade moodle-nnUpgrade moodle-msUpgrade moodle-bsUpgrade moodle-itUpgrade moodle-heUpgrade moodle-gl | Feb 17, 2015 | Apr 29, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub