The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input.
CVSS Details
- CVSS 3.1 Base Score: 4.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade wordpress | Jul 30, 2024 | Jun 28, 2010 |
| Moodle | — | Upgrade to the latest version of Moodle | Dec 4, 2018 | Jun 28, 2010 |
| Suse | — | Upgrade moodle-kmUpgrade moodle-svUpgrade moodle-idUpgrade moodle-tlUpgrade moodle-beUpgrade moodle-arUpgrade moodle-elUpgrade moodleUpgrade moodle-caUpgrade moodle-glUpgrade moodle-isUpgrade moodle-gaUpgrade moodle-slUpgrade moodle-skUpgrade moodle-knUpgrade moodle-ruUpgrade moodle-faUpgrade moodle-huUpgrade moodle-esUpgrade moodle-srUpgrade moodle-jaUpgrade moodle-hiUpgrade moodle-mi_tnUpgrade moodle-daUpgrade moodle-soUpgrade moodle-msUpgrade moodle-lvUpgrade moodle-nnUpgrade moodle-hrUpgrade moodle-ltUpgrade moodle-ptUpgrade moodle-roUpgrade moodle-plUpgrade moodle-csUpgrade moodle-fiUpgrade moodle-deUpgrade moodle-bgUpgrade moodle-heUpgrade moodle-frUpgrade moodle-bsUpgrade moodle-koUpgrade moodle-etUpgrade moodle-itUpgrade moodle-noUpgrade moodle-viUpgrade moodle-thUpgrade moodle-zh_cnUpgrade moodle-euUpgrade moodle-afUpgrade moodle-de_duUpgrade moodle-kaUpgrade moodle-trUpgrade moodle-sqUpgrade moodle-nlUpgrade moodle-uk | Feb 17, 2015 | Jun 28, 2010 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub