PT-2008-3066 · Moodle+2 · Moodle+2

Publicado 2008-03-25 · Atualizado 2022-05-01 · CVE-2008-1502

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions eGroupWare versions prior to 1.4.003 Moodle versions prior to 1.8.5

Description The issue allows remote attackers to bypass HTML filtering and conduct cross-site scripting (XSS) attacks via a string containing crafted URL protocols. This is due to the bad protocol once function in phpgwapi/inc/class.kses.inc.php in KSES.

Recommendations For eGroupWare versions prior to 1.4.003, update to version 1.4.003 or later. For Moodle versions prior to 1.8.5, update to version 1.8.5 or later. As a temporary workaround, consider restricting the input of crafted URL protocols to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-1502

DSA-1691-1

DSA-1871-1

DSA-1871-2

GHSA-V759-3WR5-P294

Produtos afetados

Kses

Moodle

Egroupware

Referências · 36

• 🔥 http://egroupware.org/viewvc/branches/1.4/phpgwapi/inc/class.kses.inc.php?r1=23625&r2=25110&pathrev=25110 · Exploit
• https://github.com/moodle/moodle · Nota
• https://redhat.com/archives/fedora-package-announce/2008-July/msg00331.html · Aviso do Fabricante
• http://secunia.com/advisories/31018 · Aviso do Fabricante
• https://web.archive.org/web/20081025081058/http://secunia.com/advisories/32400 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00006.html · Aviso do Fabricante
• http://securityfocus.com/bid/28424 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2008-1502 · Nota de Segurança
• https://web.archive.org/web/20080905011948/http://secunia.com/advisories/31018 · Nota
• http://openwall.com/lists/oss-security/2008/07/08/14 · Nota
• http://secunia.com/advisories/32446 · Aviso do Fabricante
• http://debian.org/security/2009/dsa-1871 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2008-1502 · Aviso do Fabricante
• http://egroupware.org/changelog · Nota
• http://vupen.com/english/advisories/2008/0989/references · Aviso do Fabricante