CVE-2010-2230: XSS
Published Jun 28, 2010
·Updated
The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input.
Affected Software
55 affected componentsFixes available
composer/moodle/moodle>=1.9.0<1.9.9
1.9.9
composer/moodle/moodle<1.8.13
1.8.13
Moodle moodle<=1.8.12
Moodle moodle=1.1.1
Moodle moodle=1.2.0
Moodle moodle=1.2.1
Moodle moodle=1.3.0
Moodle moodle=1.3.1
Moodle moodle=1.3.2
Moodle moodle=1.3.3
Moodle moodle=1.3.4
Moodle moodle=1.4.1
Moodle moodle=1.4.2
Moodle moodle=1.4.3
Moodle moodle=1.4.4
Moodle moodle=1.4.5
Moodle moodle=1.5
Moodle moodle=1.5.0-beta
Moodle moodle=1.5.1
Moodle moodle=1.5.2
Moodle moodle=1.5.3
Moodle moodle=1.6.0
Moodle moodle=1.6.1
Moodle moodle=1.6.2
Moodle moodle=1.6.3
Moodle moodle=1.6.4
Moodle moodle=1.6.5
Moodle moodle=1.6.6
Moodle moodle=1.6.7
Moodle moodle=1.6.8
Moodle moodle=1.7.1
Moodle moodle=1.7.2
Moodle moodle=1.7.3
Moodle moodle=1.7.4
Moodle moodle=1.7.5
Moodle moodle=1.7.6
Moodle moodle=1.8.1
Moodle moodle=1.8.2
Moodle moodle=1.8.3
Moodle moodle=1.8.4
Moodle moodle=1.8.5
Moodle moodle=1.8.6
Moodle moodle=1.8.7
Moodle moodle=1.8.8
Moodle moodle=1.8.9
Moodle moodle=1.8.10
Moodle moodle=1.8.11
Moodle moodle=1.9.1
Moodle moodle=1.9.2
Moodle moodle=1.9.3
Moodle moodle=1.9.4
Moodle moodle=1.9.5
Moodle moodle=1.9.6
Moodle moodle=1.9.7
Moodle moodle=1.9.8
Remediation
Event History
Jun 28, 2010
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
May 13, 2022
Advisory Published
via GitHub·01:13 AM
Frequently Asked Questions
1
What is the severity of CVE-2010-2230?
CVE-2010-2230 is categorized as a high severity vulnerability due to its potential for cross-site scripting (XSS) attacks.
2
How do I fix CVE-2010-2230?
To resolve CVE-2010-2230, upgrade Moodle to version 1.9.9 or 1.8.13 or higher.
3
Which versions of Moodle are affected by CVE-2010-2230?
CVE-2010-2230 affects numerous versions of Moodle, including all versions prior to 1.8.13 and 1.9.9.
4
What type of attacks can CVE-2010-2230 facilitate?
CVE-2010-2230 can facilitate cross-site scripting (XSS) attacks via malicious HTML input.
5
Who can exploit CVE-2010-2230?
CVE-2010-2230 can be exploited by remote authenticated users who send crafted HTML input.