GitHub Advisoryadvisory · Packagist

GHSA-9fmw-m4qx-6cq8 Moodle cross-site scripting (XSS) vulnerability

LOW Published 2022-05-13 Modified 2024-01-26 Official page ↗
Aliases
CVE-2015-3178
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Low
Weaknesses
CWE-79
Reviewed
2024-01-26

Affected packages

• Packagist moodle/moodle: < 2.6.11 → fixed in 2.6.11 • Packagist moodle/moodle: >= 2.7.0, < 2.7.8 → fixed in 2.7.8 • Packagist moodle/moodle: >= 2.8.0, < 2.8.6 → fixed in 2.8.6

Description

Cross-site scripting (XSS) vulnerability in the external_format_text function in lib/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to inject arbitrary web script or HTML into an external application via a crafted string that is visible to web services.

Related

Alias · CVE (1)

  • CVE-2015-3178 Cross-site scripting (XSS) vulnerability in the external_format_text function in lib/externallib.php in Moodle through 2.5.9, 2.6.x before… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References