moodle/moodle · Security
Moodle XSS In Tag Autocomplete functionality
- GHSA ID
- GHSA-6656-6qwx-4c2m
- CVE ID
- CVE-2011-4278
- Severity
- medium
- Published
- Updated
Description
Cross-site scripting (XSS) vulnerability in the tag autocomplete functionality in Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- https://nvd.nist.gov/vuln/detail/CVE-2011-4278 ↗
- http://git.moodle.org/gw?p=moodle.git;a=commit;h=fd29b2ad1c20906da00d7e523f39bc8a0358a65b ↗
- http://moodle.org/mod/forum/discuss.php?d=170003 ↗
- http://openwall.com/lists/oss-security/2011/11/14/1 ↗
- https://github.com/moodle/moodle/commit/34b93e39a64a68e4a676b93ccf2bd87a1d3b5ef8 ↗
- https://github.com/moodle/moodle/commit/fd29b2ad1c20906da00d7e523f39bc8a0358a65b ↗
- https://github.com/advisories/GHSA-6656-6qwx-4c2m ↗