Description

Cross-site scripting (XSS) vulnerability in the user_get_user_details function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to inject arbitrary web script or HTML by leveraging absence of an external_format_text call in a web service.

Remediation

References

CVE-2015-3274

Related Vulnerabilities

Oracle JRE CVE-2022-21360 Vulnerability (CVE-2022-21360)

MySQL CVE-2015-2571 Vulnerability (CVE-2015-2571)

WordPress Plugin Ajax Search Lite Remote Command Execution (3.1)

WordPress Plugin VideoWhisper Video Conference Integration 'vw_upload.php' Arbitrary File Upload (4.51)

WordPress Plugin Swipe Checkout for Jigoshop Cross-Site Scripting (3.1.0)

Severity

Medium

Classification

CVE-2015-3274 CWE-707 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities