GitHub Advisoryadvisory · Packagist

GHSA-2hw6-6rgf-726v Moodle XSS Vulnerability

MEDIUM Published 2022-05-13 Modified 2023-12-07 Official page ↗
Aliases
CVE-2015-5337
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-08-01

Affected packages

• Packagist moodle/moodle: <= 2.6.11 (no fix yet) • Packagist moodle/moodle: >= 2.7.0, < 2.7.11 → fixed in 2.7.11 • Packagist moodle/moodle: >= 2.8.0, < 2.8.9 → fixed in 2.8.9 • Packagist moodle/moodle: >= 2.9.0, < 2.9.3 → fixed in 2.9.3

Description

Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly restrict the availability of Flowplayer, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted .swf file.

Related

Alias · CVE (1)

  • CVE-2015-5337 Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly restrict the availability of… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References