PT-2014-8812 · Moodle · Moodle

Petr Skoda · Published 2014-11-24 · Updated 2022-05-13 · CVE-2014-9059

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 2.4.11 and earlier, 2.5.x before 2.5.9, 2.6.x before 2.6.6, 2.7.x before 2.7.3

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via UTF-7 characters during interaction with AJAX scripts, due to the lack of charset information in HTTP headers.

Recommendations For versions 2.4.11 and earlier, update to version 2.4.12 or later. For versions 2.5.x before 2.5.9, update to version 2.5.9 or later. For versions 2.6.x before 2.6.6, update to version 2.6.6 or later. For versions 2.7.x before 2.7.3, update to version 2.7.3 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-9059

GHSA-CRCQ-PW8H-9XWF

Affected Products

Moodle

References · 14

• https://osv.dev/vulnerability/GHSA-crcq-pw8h-9xwf · Vendor Advisory
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47966 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2014-9059 · Security Note
• https://moodle.org/mod/forum/discuss.php?d=275146 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/3c98b7a5ad1bb596a738e550fc3bf966d6415fe0 · Note
• https://github.com/moodle/moodle/commit/ac6e453d11024bf6ad99ada1bfc641c6b91ebed6 · Note
• https://github.com/moodle/moodle/commit/293e4bbcb71f0a801c2539ea051c58688314b23a · Note
• https://github.com/moodle/moodle/commit/0a0145c5e8041aadeff303a9f9984c86706b4e42 · Note
• http://securityfocus.com/bid/71133 · Note
• https://web.archive.org/web/20150914064838/http://securitytracker.com/id/1031215 · Note
• http://securitytracker.com/id/1031215 · Note
• http://openwall.com/lists/oss-security/2014/11/17/11 · Note
• https://web.archive.org/web/20200229043651/http://securityfocus.com/bid/71133 · Note