PT-2014-8812 · Moodle · Moodle

Petr Skoda · Publicado 2014-11-24 · Atualizado 2022-05-13 · CVE-2014-9059

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 2.4.11 and earlier, 2.5.x before 2.5.9, 2.6.x before 2.6.6, 2.7.x before 2.7.3

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via UTF-7 characters during interaction with AJAX scripts, due to the lack of charset information in HTTP headers.

Recommendations For versions 2.4.11 and earlier, update to version 2.4.12 or later. For versions 2.5.x before 2.5.9, update to version 2.5.9 or later. For versions 2.6.x before 2.6.6, update to version 2.6.6 or later. For versions 2.7.x before 2.7.3, update to version 2.7.3 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-9059

GHSA-CRCQ-PW8H-9XWF

Produtos afetados

Moodle

Referências · 14

• https://github.com/moodle/moodle · Nota
• https://github.com/moodle/moodle/commit/3c98b7a5ad1bb596a738e550fc3bf966d6415fe0 · Nota
• https://github.com/moodle/moodle/commit/ac6e453d11024bf6ad99ada1bfc641c6b91ebed6 · Nota
• https://github.com/moodle/moodle/commit/293e4bbcb71f0a801c2539ea051c58688314b23a · Nota
• https://github.com/moodle/moodle/commit/0a0145c5e8041aadeff303a9f9984c86706b4e42 · Nota
• http://securityfocus.com/bid/71133 · Nota
• https://web.archive.org/web/20150914064838/http://securitytracker.com/id/1031215 · Nota
• https://osv.dev/vulnerability/GHSA-crcq-pw8h-9xwf · Aviso do Fabricante
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47966 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2014-9059 · Nota de Segurança
• http://securitytracker.com/id/1031215 · Nota
• http://openwall.com/lists/oss-security/2014/11/17/11 · Nota
• https://web.archive.org/web/20200229043651/http://securityfocus.com/bid/71133 · Nota
• https://moodle.org/mod/forum/discuss.php?d=275146 · Aviso do Fabricante