Moodle cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2014-3544US | low3.5 | Exploit | ||
Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows re… | ||||
02
references
External citations — patches, advisories, analysis.
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45683WEB
- http://openwall.com/lists/oss-security/2014/07/21/1WEB
- http://osandamalith.wordpress.com/2014/07/25/moodle-2-7-persistent-xssWEB
- http://osvdb.org/show/osvdb/109337WEB
- http://packetstormsecurity.com/files/127624/Moodle-2.7-Cross-Site-Scripting.htmlWEB
- http://www.exploit-db.com/exploits/34169WEB
- http://www.securityfocus.com/bid/68756WEB
- https://github.com/moodle/moodlePACKAGE
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan