PT-2015-1608 · Moodle · Moodle
Damyon Wiese
·
Publicado
2015-06-01
·
Atualizado
2022-05-13
·
CVE-2015-0216
CVSS v2.0
3.5
Baixa
| Vetor | AV:N/AC:M/Au:S/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Moodle versions 2.8.x through 2.8.1
Description
The issue allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted essay feedback. This is due to the failure to set the RISK XSS bit for graders in the access.php file of the Lesson module. The exploitation of this issue may enable a remote attacker to perform cross-site scripting using the feedback form.
Recommendations
For Moodle versions 2.8.x through 2.8.1, update to version 2.8.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the Lesson module's essay feedback feature until the update is applied.
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Moodle