The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input.
CVSS Details
- CVSS 3.1 Base Score: 4.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade wordpress | Jul 30, 2024 | Jun 28, 2010 |
| Moodle | — | Upgrade to the latest version of Moodle | Dec 4, 2018 | Jun 28, 2010 |
| Suse | — | Upgrade moodle-heUpgrade moodle-koUpgrade moodle-ptUpgrade moodle-deUpgrade moodle-de_duUpgrade moodle-ukUpgrade moodle-thUpgrade moodle-afUpgrade moodle-euUpgrade moodle-bgUpgrade moodle-viUpgrade moodle-ltUpgrade moodle-caUpgrade moodle-skUpgrade moodle-hiUpgrade moodle-kmUpgrade moodle-hrUpgrade moodle-tlUpgrade moodle-nnUpgrade moodle-lvUpgrade moodle-srUpgrade moodle-idUpgrade moodle-jaUpgrade moodleUpgrade moodle-soUpgrade moodle-arUpgrade moodle-glUpgrade moodle-elUpgrade moodle-isUpgrade moodle-esUpgrade moodle-faUpgrade moodle-ruUpgrade moodle-mi_tnUpgrade moodle-knUpgrade moodle-huUpgrade moodle-svUpgrade moodle-daUpgrade moodle-gaUpgrade moodle-beUpgrade moodle-slUpgrade moodle-msUpgrade moodle-fiUpgrade moodle-itUpgrade moodle-etUpgrade moodle-frUpgrade moodle-bsUpgrade moodle-roUpgrade moodle-plUpgrade moodle-nl | Feb 17, 2015 | Jun 28, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub