What is GHSA-2hw6-6rgf-726v?

GHSA-2hw6-6rgf-726v is a security advisory published by GitHub Security Advisories with Medium severity. Moodle XSS Vulnerability

Which CVE IDs does GHSA-2hw6-6rgf-726v cover?

GHSA-2hw6-6rgf-726v covers the following CVE IDs: CVE-2015-5337. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2hw6-6rgf-726v?

GHSA-2hw6-6rgf-726v has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-2hw6-6rgf-726v?

GHSA-2hw6-6rgf-726v affects 4 products, including: composer/moodle/moodle:\u003c= 2.6.11; composer/moodle/moodle:\u003e= 2.7.0, \u003c 2.7.11; composer/moodle/moodle:\u003e= 2.8.0, \u003c 2.8.9; composer/moodle/moodle:\u003e= 2.9.0, \u003c 2.9.3.

GHSA-2hw6-6rgf-726vMediumCVSS 6.1

Moodle XSS Vulnerability

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

December 7, 2023

🔗 CVE IDs covered (1)

CVE-2015-5337 →

📋 Description

Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly restrict the availability of Flowplayer, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted .swf file.

🎯 Affected products4

composer/moodle/moodle:<= 2.6.11
composer/moodle/moodle:>= 2.7.0, < 2.7.11
composer/moodle/moodle:>= 2.8.0, < 2.8.9
composer/moodle/moodle:>= 2.9.0, < 2.9.3

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2015-5337
https://moodle.org/mod/forum/discuss.php?d=323232
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48085
https://github.com/moodle/moodle/commit/c73f6d03e5037729097bb9f5f5a55be15f3cab18
https://github.com/advisories/GHSA-2hw6-6rgf-726v