low3.5Public exploit code
CVE-2015-2269
Multiple cross-site scripting (XSS) vulnerabilities in lib/javascript-static.js in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x befo…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Moodle 2.5.9/2.6.8/2.7.5/2.8.3 - Block Title Handler Cross-Site Scripting2015-03-17 · webapps · php
Impact
Multiple cross-site scripting (XSS) vulnerabilities in lib/javascript-static.js in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) alt or (2) title attribute in an IMG element.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Moodle | Moodle | through 2.5.9 Versions 2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.5.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49144
- http://openwall.com/lists/oss-security/2015/03/16/1
- https://moodle.org/mod/forum/discuss.php?d=307383
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49144
- http://openwall.com/lists/oss-security/2015/03/16/1
- https://moodle.org/mod/forum/discuss.php?d=307383