CVEvulnerability

CVE-2008-3260

4.3 MEDIUM Published 2008-07-22 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2008-07-22
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in Claroline before 1.8.10 allow remote attackers to inject arbitrary web script or HTML via (1) the cwd parameter in a rqMkHtml action to document/rqmkhtml.php, or the query string to (2) announcements/announcements.php, (3) calendar/agenda.php, (4) course/index.php, (5) course_description/index.php, (6) document/document.php, (7) exercise/exercise.php, (8) group/group_space.php, (9) phpbb/newtopic.php, (10) phpbb/reply.php, (11) phpbb/viewtopic.php, (12) wiki/wiki.php, or (13) work/work.php in claroline/.

Affected configurations

• claroline claroline (<= 1.8.9) • claroline claroline 1.2 • claroline claroline 1.3 • claroline claroline 1.4 • claroline claroline 1.5 • claroline claroline 1.5.3 • claroline claroline 1.5.4 • claroline claroline 1.6 • claroline claroline 1.6 beta • claroline claroline 1.6 rc1 • claroline claroline 1.7 • claroline claroline 1.7.1 • claroline claroline 1.7.2 • claroline claroline 1.7.3 • claroline claroline 1.7.4 • claroline claroline 1.7.5 • claroline claroline 1.7.6 • claroline claroline 1.7.7 • claroline claroline 1.8.0 • claroline claroline 1.8.1 • claroline claroline 1.8.2 • claroline claroline 1.8.3 • claroline claroline 1.8.4 • claroline claroline 1.8.5 • claroline claroline 1.8.6 • claroline claroline 1.8.7 • claroline claroline 1.8.8

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References