Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-3389)

Description

Multiple cross-site scripting (XSS) vulnerabilities in mod/lti/typessettings.php in Moodle 2.2.x before 2.2.4 and 2.3.x before 2.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) lti_typename or (2) lti_toolurl parameter.

Remediation

References

CVE-2012-3389

Related Vulnerabilities

OpenSSL Use of a Broken or Risky Cryptographic Algorithm Vulnerability (CVE-2018-0737)

WordPress Plugin Mailtree Log Mail Cross-Site Scripting (1.0.0)

Oracle Application Server CVE-2007-5521 Vulnerability (CVE-2007-5521)

WordPress Plugin Real-Time Find and Replace Cross-Site Request Forgery (3.9)

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-1136)

Severity

Medium

Classification

CVE-2012-3389 CWE-707