CVE-2009-0502: XSS
First published: Tue Feb 10 2009(Updated: )
Cross-site scripting (XSS) vulnerability in blocks/html/block_html.php in Snoopy 1.2.3, as used in Moodle 1.6 before 1.6.9, 1.7 before 1.7.7, 1.8 before 1.8.8, and 1.9 before 1.9.4, allows remote attackers to inject arbitrary web script or HTML via an HTML block, which is not properly handled when the "Login as" feature is used to visit a MyMoodle or Blog page.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Snoopy project Snoopy | =1.2.3 | |
| Moodle | =1.7.0 | |
| Moodle | =1.7.1 | |
| Moodle | =1.7.2 | |
| Moodle | =1.7.3 | |
| Moodle | =1.7.4 | |
| Moodle | =1.7.5 | |
| Moodle | =1.7.6 | |
| Moodle | =1.8.1 | |
| Moodle | =1.8.2 | |
| Moodle | =1.8.3 | |
| Moodle | =1.8.4 | |
| Moodle | =1.8.5 | |
| Moodle | =1.8.6 | |
| Moodle | =1.8.7 | |
| Moodle | =1.9.1 | |
| Moodle | =1.9.2 | |
| Moodle | =1.9.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2009-0502?
CVE-2009-0502 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2009-0502?
To fix CVE-2009-0502, you should update to a patched version of Moodle or Snoopy that addresses the XSS vulnerability.
Which versions are affected by CVE-2009-0502?
CVE-2009-0502 affects Snoopy 1.2.3 and various versions of Moodle from 1.6 to 1.9 before their respective patches.
Can CVE-2009-0502 be exploited remotely?
Yes, CVE-2009-0502 can be exploited remotely by injecting malicious scripts through an HTML block.
What types of attacks are possible due to CVE-2009-0502?
CVE-2009-0502 allows attackers to perform cross-site scripting (XSS) attacks, which can lead to hijacking of user sessions or information theft.
- collector/nvd-historical
- agent/references
- agent/type
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/author
- agent/tags
- agent/softwarecombine
- agent/description
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/snoopy
- canonical/snoopy project snoopy
- version/snoopy project snoopy/1.2.3
- vendor/moodle
- canonical/moodle
- version/moodle/1.7.0
- version/moodle/1.7.1
- version/moodle/1.7.2
- version/moodle/1.7.3
- version/moodle/1.7.4
- version/moodle/1.7.5
- version/moodle/1.7.6
- version/moodle/1.8.1
- version/moodle/1.8.2
- version/moodle/1.8.3
- version/moodle/1.8.4
- version/moodle/1.8.5
- version/moodle/1.8.6
- version/moodle/1.8.7
- version/moodle/1.9.1
- version/moodle/1.9.2
- version/moodle/1.9.3