Description

Cross-site scripting (XSS) vulnerability in the get_description function in lib/classes/event/user_login_failed.php in Moodle 2.7.x before 2.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted username that is improperly handled during the logging of an invalid login attempt.

Remediation

References

CVE-2014-3549

Related Vulnerabilities

WordPress Plugin blogVault Real-time Backup PHP Object Injection (1.44)

Drupal Core 8.x.x Directory Traversal (8.0.0 - 8.8.12)

WordPress Permissions, Privileges, and Access Controls Vulnerability (CVE-2011-5270)

Oracle Application Server CVE-2008-3977 Vulnerability (CVE-2008-3977)

Undertow CVE-2022-1259 Vulnerability (CVE-2022-1259)

Severity

Medium

Classification

CVE-2014-3549 CWE-707

Tags

Missing Update Known Vulnerabilities