CVE-2011-4278: XSS
Published Jul 16, 2012
·Updated
Cross-site scripting (XSS) vulnerability in the tag autocomplete functionality in Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Software
14 affected componentsFixes available
composer/moodle/moodle<1.9.11
1.9.11
composer/moodle/moodle>=2.0<2.0.2
2.0.2
Moodle moodle=1.9.1
Moodle moodle=1.9.2
Moodle moodle=1.9.3
Moodle moodle=1.9.4
Moodle moodle=1.9.5
Moodle moodle=1.9.6
Moodle moodle=1.9.7
Moodle moodle=1.9.8
Moodle moodle=1.9.9
Moodle moodle=1.9.10
Moodle moodle=2.0.0
Moodle moodle=2.0.1
Remediation
Event History
Jul 16, 2012
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
May 13, 2022
Advisory Published
via GitHub·01:13 AM
Frequently Asked Questions
1
What is the severity of CVE-2011-4278?
CVE-2011-4278 is classified as a medium severity cross-site scripting (XSS) vulnerability.
2
How do I fix CVE-2011-4278?
To fix CVE-2011-4278, upgrade Moodle to version 1.9.11 or 2.0.2 or later.
3
What versions of Moodle are affected by CVE-2011-4278?
CVE-2011-4278 affects Moodle versions 1.9.1 through 1.9.10 and 2.0.0 through 2.0.1.
4
What type of vulnerability is CVE-2011-4278?
CVE-2011-4278 is a cross-site scripting (XSS) vulnerability.
5
Can CVE-2011-4278 be exploited remotely?
Yes, CVE-2011-4278 can be exploited remotely by attackers to inject arbitrary web scripts or HTML.