Description

access.php in the Lesson module in Moodle 2.8.x before 2.8.2 does not set the RISK_XSS bit for graders, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted essay feedback.

Remediation

References

CVE-2015-0216

Related Vulnerabilities

PmWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2010-4662)

Plone CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2011-1948)

WordPress 4.2.x Denial of Service Vulnerability (4.2 - 4.2.19)

Apache Tomcat Other Vulnerability (CVE-2011-1183)

WordPress Plugin PDF Viewer Cross-Site Scripting (0.1)

Severity

Low

Classification

CVE-2015-0216 CWE-707

Tags

Missing Update Known Vulnerabilities