PT-2013-5061 · Moodle · Moodle

Michael Hess · Published 2013-11-26 · Updated 2020-12-01 · CVE-2013-4525

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 2.2.11 Moodle versions 2.3.x before 2.3.10 Moodle versions 2.4.x before 2.4.7 Moodle versions 2.5.x before 2.5.3

Description A cross-site scripting (XSS) issue allows remote authenticated users to inject arbitrary web script or HTML via an answer to a text-based quiz question. This occurs due to insufficient input validation in the quiz module.

Recommendations For versions prior to 2.2.11, update to version 2.2.11 or later. For versions 2.3.x before 2.3.10, update to version 2.3.10 or later. For versions 2.4.x before 2.4.7, update to version 2.4.7 or later. For versions 2.5.x before 2.5.3, update to version 2.5.3 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-4525

MGASA-2013-0356

Affected Products

Moodle

References · 16

• 🔥 http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-41820 · Exploit
• https://advisories.mageia.org/MGASA-2013-0356.html · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-4525 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2013-0356 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-4525 · Security Note
• https://moodle.org/mod/forum/discuss.php?d=244482 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-4525 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4525 · Security Note
• https://moodle.org/mod/forum/discuss.php?d=244479 · Note
• https://moodle.org/mod/forum/discuss.php?d=244481 · Note
• https://moodle.org/mod/forum/discuss.php?d=243213 · Note
• https://moodle.org/mod/forum/discuss.php?d=244480 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4525 · Note
• http://openwall.com/lists/oss-security/2013/11/25/1 · Note
• https://bugs.mageia.org/show_bug.cgi?id=11671 · Note