What is GHSA-hhxf-w8hj-43w6?

GHSA-hhxf-w8hj-43w6 is a security advisory published by GitHub Security Advisories with Low severity. Moodle vulnerable to Cross-site Scripting

Which CVE IDs does GHSA-hhxf-w8hj-43w6 cover?

GHSA-hhxf-w8hj-43w6 covers the following CVE IDs: CVE-2010-1619. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-hhxf-w8hj-43w6?

GHSA-hhxf-w8hj-43w6 affects 2 products, including: composer/moodle/moodle:\u003e= 1.8.0, \u003c 1.8.12; composer/moodle/moodle:\u003e= 1.9.0, \u003c 1.9.8.

GHSA-hhxf-w8hj-43w6Low

Moodle vulnerable to Cross-site Scripting

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

April 11, 2025

🔗 CVE IDs covered (1)

CVE-2010-1619 →

📋 Description

Cross-site scripting (XSS) vulnerability in the fix_non_standard_entities function in the KSES HTML text cleaning library (weblib.php), as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via crafted HTML entities.

🎯 Affected products2

composer/moodle/moodle:>= 1.8.0, < 1.8.12
composer/moodle/moodle:>= 1.9.0, < 1.9.8

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2010-1619
http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html
http://www.vupen.com/english/advisories/2010/1107
http://moodle.org/security
https://github.com/advisories/GHSA-hhxf-w8hj-43w6