Description

access.php in the Lesson module in Moodle 2.8.x before 2.8.2 does not set the RISK_XSS bit for graders, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted essay feedback.

Remediation

References

CVE-2015-0216

Related Vulnerabilities

PHP Improper Input Validation Vulnerability (CVE-2015-3330)

MySQL Resource Management Errors Vulnerability (CVE-2010-3679)

PHP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2006-0208)

IBM RTC Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-1559)

WordPress Plugin WP Maintenance Mode Cross-Site Scripting (2.2.3)

Severity

Low

Classification

CVE-2015-0216 CWE-707

Tags

Missing Update Known Vulnerabilities