PT-2016-1290 · Moodle · Moodle

Marina Glancy · Publicado 2015-08-03 · Atualizado 2022-05-13 · CVE-2015-3274

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 2.6.11 and earlier, 2.7.x through 2.7.8, 2.8.x through 2.8.6, 2.9.x through 2.9.0

Description A cross-site scripting (XSS) issue exists due to the absence of an external format text call in a web service, allowing remote attackers to inject arbitrary web script or HTML. This is related to the user get user details function in user/lib.php.

Recommendations For versions 2.6.11 and earlier, update to version 2.7.9 or later. For versions 2.7.x through 2.7.8, update to version 2.7.9 or later. For versions 2.8.x through 2.8.6, update to version 2.8.7 or later. For versions 2.9.x through 2.9.0, update to version 2.9.1 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2016-00587

CVE-2015-3274

GHSA-F7QM-Q26P-6RR2

MGASA-2015-0302

Produtos afetados

Moodle

Referências · 24

• https://github.com/moodle/moodle · Nota
• https://github.com/moodle/moodle/commit/e96e66aa16dca5cbcdb1aef0f9499edf86f1404b · Nota
• https://github.com/moodle/moodle/commit/a809a8dccea222a31e0828d4f17889035e6d1a36 · Nota
• https://github.com/moodle/moodle/commit/7b15a363201109354bbd6d51a7c70f50dac7b9d8 · Nota
• https://github.com/moodle/moodle/commit/ffe5c784889b3f7b2ba11cf9db881d54904623b7 · Nota
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50130 · Nota
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50130 · Nota
• http://openwall.com/lists/oss-security/2015/07/13/2 · Nota
• https://osv.dev/vulnerability/GHSA-f7qm-q26p-6rr2 · Aviso do Fabricante
• https://moodle.org/mod/forum/discuss.php?d=316289 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-3274 · Nota de Segurança
• https://moodle.org/mod/forum/discuss.php?d=316664 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2015-0302 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=16374 · Nota
• https://bdu.fstec.ru/vul/2016-00587 · Nota de Segurança