GitHub Advisoryadvisory · Packagist

GHSA-86v9-gqh9-8268 Moodle vulnerable to Cross-site Scripting

MEDIUM Published 2022-05-13 Modified 2025-04-12 Official page ↗
Aliases
CVE-2011-4286
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2025-04-12

Affected packages

• Packagist moodle/moodle: >= 1.9.0, < 1.9.11 → fixed in 1.9.11 • Packagist moodle/moodle: >= 2.0.0, < 2.0.2 → fixed in 2.0.2

Description

Multiple cross-site scripting (XSS) vulnerabilities in the media-filter implementation in filter/mediaplugin/filter.php in Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) Flash Video (aka FLV) files and (2) YouTube videos.

Related

Alias · CVE (1)

  • CVE-2011-4286 Multiple cross-site scripting (XSS) vulnerabilities in the media-filter implementation in filter/mediaplugin/filter.php in Moodle 1.9.x… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References