Cross-site scripting (XSS) vulnerability in the fix_non_standard_entities function in the KSES HTML text cleaning library (weblib.php), as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via crafted HTML entities.
CVSS Details
- CVSS 3.1 Base Score: 6.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Moodle | — | Upgrade to the latest version of Moodle | Dec 4, 2018 | Apr 29, 2010 |
| Suse | — | Upgrade moodle-ukUpgrade moodle-nlUpgrade moodle-kaUpgrade moodle-sqUpgrade moodle-fiUpgrade moodle-itUpgrade moodle-ptUpgrade moodle-frUpgrade moodle-bsUpgrade moodle-csUpgrade moodle-noUpgrade moodle-thUpgrade moodle-etUpgrade moodle-heUpgrade moodle-kmUpgrade moodle-afUpgrade moodle-deUpgrade moodle-viUpgrade moodle-de_duUpgrade moodle-trUpgrade moodle-zh_cnUpgrade moodle-bgUpgrade moodle-lvUpgrade moodle-jaUpgrade moodle-plUpgrade moodle-euUpgrade moodle-roUpgrade moodle-koUpgrade moodle-huUpgrade moodle-esUpgrade moodle-soUpgrade moodle-caUpgrade moodle-gaUpgrade moodle-srUpgrade moodle-tlUpgrade moodle-ruUpgrade moodle-svUpgrade moodle-faUpgrade moodle-ltUpgrade moodle-glUpgrade moodle-mi_tnUpgrade moodle-beUpgrade moodle-daUpgrade moodleUpgrade moodle-slUpgrade moodle-elUpgrade moodle-isUpgrade moodle-msUpgrade moodle-hiUpgrade moodle-knUpgrade moodle-skUpgrade moodle-arUpgrade moodle-idUpgrade moodle-hrUpgrade moodle-nn | Feb 17, 2015 | Apr 29, 2010 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub