Moodle is prone to multiple vulnerabilities, including: - a cross-site scripting issue - a security-bypass issue - an HTML-injection issue Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing an attacker to steal cookie- based authentication credentials and to control how the site is rendered to the user other attacks are also possible. These issues affect versions prior to Moodle 1.9.9 and 1.8.13.

Updates are available. Please see the references for more information.

• http://moodle.org/mod/forum/discuss.php?d=152366
• http://moodle.org/mod/forum/discuss.php?d=152367
• http://moodle.org/mod/forum/discuss.php?d=152368
• http://moodle.org/mod/forum/discuss.php?d=152369
• http://moodle.org/security/
• http://www.moodle.org
• https://www.securityfocus.com/bid/40944

---

Updated on 2015-03-25