GHSA-5fgv-cvr8-xg48Low

Moodle vulnerable to Cross-site Scripting

Published
May 13, 2022
Last Modified
April 11, 2025

🔗 CVE IDs covered (1)

CVE-2010-1614 →

📋 Description

Multiple cross-site scripting (XSS) vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the Login-As feature or (2) when the global search feature is enabled, unspecified global search forms in the Global Search Engine. NOTE: vector 1 might be resultant from a cross-site request forgery (CSRF) vulnerability.

🎯 Affected products2

  • composer/moodle/moodle:>= 1.8.0, < 1.8.12
  • composer/moodle/moodle:>= 1.9.0, < 1.9.8

🔗 References (4)