Description

A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. When a quiz question bank is imported, it was possible for the question preview that is displayed to execute JavaScript that is written into the question bank.

Remediation

References

CVE-2018-10891

Related Vulnerabilities

WordPress Plugin Genie WP Favicon Cross-Site Request Forgery (0.5.2)

WordPress Plugin xPinner Lite Multiple Vulnerabilities (2.2)

TYPO3 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression La Vulnerability (CVE-2022-23504)

WordPress Plugin Simplified Content Cross-Site Scripting (1.0.0)

WordPress Plugin Fonts-Google Fonts Typography Cross-Site Scripting (3.0.2)

Severity

High

Classification

CVE-2018-10891 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Tags

Missing Update Known Vulnerabilities