PT-2016-1302 · Moodle · Moodle

Hugh Davenport

·

Publicado

2015-12-05

·

Atualizado

2022-05-13

·

CVE-2015-5336

CVSS v3.1

5.4

Média

VetorAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Moodle versions prior to 2.6.11 Moodle versions 2.7.x before 2.7.11 Moodle versions 2.8.x before 2.8.9 Moodle versions 2.9.x before 2.9.3
Description The issue exists due to the lack of protection for the web page structure in the survey module of the Moodle learning management system. This allows a remote attacker, using the student role and a specially crafted survey answer, to inject arbitrary web or HTML code.
Recommendations For versions prior to 2.6.11, update to version 2.6.11 or later. For versions 2.7.x before 2.7.11, update to version 2.7.11 or later. For versions 2.8.x before 2.8.9, update to version 2.8.9 or later. For versions 2.9.x before 2.9.3, update to version 2.9.3 or later.

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2016-00599
CVE-2015-5336
GHSA-GRVW-QQ2J-R898
MGASA-2015-0464

Produtos afetados

Moodle