Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2010-2230)

Description

The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input.

Remediation

References

CVE-2010-2230

Related Vulnerabilities

WordPress Plugin xili-tidy-tags Cross-Site Request Forgery (1.12.03)

MySQL CVE-2014-4214 Vulnerability (CVE-2014-4214)

RubyGems Cryptographic Issues Vulnerability (CVE-2013-4287)

FluxBB Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-35240)

WordPress Plugin Simple Personal Message SQL Injection (1.0.3)

Severity

Medium

Classification

CVE-2010-2230 CWE-707