GitHub Advisoryadvisory · Packagist

GHSA-89f3-74m6-g27g Moodle Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module

LOW Published 2022-05-13 Modified 2023-08-17 Official page ↗
Aliases
CVE-2013-1833
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Low
Weaknesses
CWE-79
Reviewed
2023-08-17

Affected packages

• Packagist moodle/moodle: >= 2.0.0, <= 2.1.10 (no fix yet) • Packagist moodle/moodle: >= 2.2.0, < 2.2.8 → fixed in 2.2.8 • Packagist moodle/moodle: >= 2.3.0, < 2.3.5 → fixed in 2.3.5 • Packagist moodle/moodle: >= 2.4.0, < 2.4.2 → fixed in 2.4.2

Description

Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted filename.

Related

Alias · CVE (1)

  • CVE-2013-1833 Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References