PT-2008-3066 · Moodle+2 · Moodle+2

Published 2008-03-25 · Updated 2022-05-01 · CVE-2008-1502

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions eGroupWare versions prior to 1.4.003 Moodle versions prior to 1.8.5

Description The issue allows remote attackers to bypass HTML filtering and conduct cross-site scripting (XSS) attacks via a string containing crafted URL protocols. This is due to the bad protocol once function in phpgwapi/inc/class.kses.inc.php in KSES.

Recommendations For eGroupWare versions prior to 1.4.003, update to version 1.4.003 or later. For Moodle versions prior to 1.8.5, update to version 1.8.5 or later. As a temporary workaround, consider restricting the input of crafted URL protocols to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-1502

DSA-1691-1

DSA-1871-1

DSA-1871-2

GHSA-V759-3WR5-P294

Affected Products

Kses

Moodle

Egroupware

References · 36

• 🔥 http://egroupware.org/viewvc/branches/1.4/phpgwapi/inc/class.kses.inc.php?r1=23625&r2=25110&pathrev=25110 · Exploit
• https://redhat.com/archives/fedora-package-announce/2008-July/msg00331.html · Vendor Advisory
• http://secunia.com/advisories/31018 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00006.html · Vendor Advisory
• http://securityfocus.com/bid/28424 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2008-1502 · Security Note
• http://secunia.com/advisories/32446 · Vendor Advisory
• http://debian.org/security/2009/dsa-1871 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-1502 · Vendor Advisory
• http://vupen.com/english/advisories/2008/0989/references · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200805-04.xml · Vendor Advisory
• http://secunia.com/advisories/31017 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-1502 · Vendor Advisory
• http://secunia.com/advisories/32400 · Vendor Advisory
• https://usn.ubuntu.com/658-1 · Vendor Advisory