CVE-2010-2228: XSS
Cross-site scripting (XSS) vulnerability in the MNET access-control interface in Moodle before 1.8.13 and 1.9.x before 1.9.9 allows remote attackers to inject arbitrary web script or HTML via vectors involving extended characters in a username.
Other sources
Moodle upstream has released v1.9.9 and v1.8.13:
http://docs.moodle.org/en/Moodle1.9.9releasenotes http://docs.moodle.org/en/Moodle1.8.13releasenotes
Which address the following issues:
MSA-10-0010 Persistent Cross Site Scripting vulnerability in the MNET access control interface MSA-10-0011 Cross Site Scripting vulnerability in blog/index.php MSA-10-0012 KSES Security Filter Bypassing vulnerability MSA-10-0013 Potential Cross Site Scripting vulnerability in Quiz reports
These would affect Fedora (currently 1.9.8) and EPEL (currently 1.8.12).
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2228?
CVE-2010-2228 is classified as a high-severity cross-site scripting (XSS) vulnerability.
How do I fix CVE-2010-2228?
To fix CVE-2010-2228, upgrade to Moodle versions 1.8.13 or 1.9.9 or later.
Which versions of Moodle are affected by CVE-2010-2228?
CVE-2010-2228 affects Moodle versions prior to 1.8.13 and 1.9.x earlier than 1.9.9.
What type of vulnerability is CVE-2010-2228?
CVE-2010-2228 is a cross-site scripting (XSS) vulnerability that allows attackers to inject arbitrary web scripts.
Can CVE-2010-2228 be exploited remotely?
Yes, CVE-2010-2228 can be exploited remotely by attackers through crafted usernames containing extended characters.