Cross-site scripting (XSS) vulnerability in the fix_non_standard_entities function in the KSES HTML text cleaning library (weblib.php), as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via crafted HTML entities.
CVSS Details
- CVSS 3.1 Base Score: 6.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Moodle | — | Upgrade to the latest version of Moodle | Dec 4, 2018 | Apr 29, 2010 |
| Suse | — | Upgrade moodle-koUpgrade moodle-csUpgrade moodle-kaUpgrade moodle-plUpgrade moodle-ptUpgrade moodle-ukUpgrade moodle-kmUpgrade moodle-euUpgrade moodle-deUpgrade moodle-heUpgrade moodle-noUpgrade moodle-sqUpgrade moodle-roUpgrade moodle-afUpgrade moodle-zh_cnUpgrade moodle-lvUpgrade moodle-etUpgrade moodle-frUpgrade moodle-fiUpgrade moodle-de_duUpgrade moodle-viUpgrade moodle-itUpgrade moodle-nlUpgrade moodle-thUpgrade moodle-trUpgrade moodle-bsUpgrade moodle-bgUpgrade moodle-jaUpgrade moodle-svUpgrade moodle-arUpgrade moodleUpgrade moodle-faUpgrade moodle-tlUpgrade moodle-hrUpgrade moodle-knUpgrade moodle-hiUpgrade moodle-soUpgrade moodle-nnUpgrade moodle-glUpgrade moodle-slUpgrade moodle-esUpgrade moodle-skUpgrade moodle-daUpgrade moodle-ruUpgrade moodle-caUpgrade moodle-huUpgrade moodle-idUpgrade moodle-mi_tnUpgrade moodle-gaUpgrade moodle-ltUpgrade moodle-isUpgrade moodle-srUpgrade moodle-beUpgrade moodle-msUpgrade moodle-el | Feb 17, 2015 | Apr 29, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub