CVE-2012-2360: XSS

Published Jul 21, 2012

Updated

Cross-site scripting (XSS) vulnerability in the Wiki subsystem in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted string that is inserted into a page title.

Affected Software

18 affected components

Moodle moodle=2.0.0

Moodle moodle=2.0.1

Moodle moodle=2.0.2

Moodle moodle=2.0.3

Moodle moodle=2.0.4

Moodle moodle=2.0.5

Moodle moodle=2.0.6

Moodle moodle=2.0.7

Moodle moodle=2.0.8

Moodle moodle=2.1.0

Moodle moodle=2.1.1

Moodle moodle=2.1.2

Moodle moodle=2.1.3

Moodle moodle=2.1.4

Moodle moodle=2.1.5

Moodle moodle=2.2.0

Moodle moodle=2.2.1

Moodle moodle=2.2.2

Event History

Jul 21, 2012

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2012-2360?

CVE-2012-2360 is classified as a high severity vulnerability due to the potential for remote users to inject arbitrary scripts.

How do I fix CVE-2012-2360?

To fix CVE-2012-2360, upgrade Moodle to versions 2.0.9, 2.1.6, or 2.2.3 or later.

Who is affected by CVE-2012-2360?

CVE-2012-2360 affects Moodle versions 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3.

What types of attacks are possible with CVE-2012-2360?

CVE-2012-2360 allows attackers to perform Cross-site scripting (XSS) attacks by injecting malicious scripts into page titles.

Is CVE-2012-2360 a client-side or server-side vulnerability?

CVE-2012-2360 is primarily a client-side vulnerability, enabling attackers to exploit vulnerabilities in users' web browsers.