CVE-2012-2362: XSS

Published Jul 21, 2012

Updated

Cross-site scripting (XSS) vulnerability in blog/lib.php in the blog implementation in Moodle 1.9.x before 1.9.18, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via a crafted parameter to blog/index.php.

Affected Software

17 affected components

Moodle moodle=1.9.1

Moodle moodle=1.9.2

Moodle moodle=1.9.3

Moodle moodle=1.9.4

Moodle moodle=1.9.5

Moodle moodle=1.9.6

Moodle moodle=1.9.7

Moodle moodle=1.9.8

Moodle moodle=1.9.9

Moodle moodle=1.9.10

Moodle moodle=1.9.11

Moodle moodle=1.9.12

Moodle moodle=1.9.13

Moodle moodle=1.9.14

Moodle moodle=1.9.15

Moodle moodle=1.9.16

Moodle moodle=1.9.17

Event History

Jul 21, 2012

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2012-2362?

The severity of CVE-2012-2362 is considered medium, as it allows for cross-site scripting which can be exploited to execute arbitrary scripts in the context of users' browsers.

How do I fix CVE-2012-2362?

To fix CVE-2012-2362, upgrade your Moodle installation to version 1.9.18 or later, where the vulnerability has been patched.

Which versions of Moodle are affected by CVE-2012-2362?

CVE-2012-2362 affects all Moodle versions from 1.9.1 to 1.9.17.

What type of vulnerability is CVE-2012-2362?

CVE-2012-2362 is a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts via crafted parameters.

Can CVE-2012-2362 be exploited on browsers other than Internet Explorer?

CVE-2012-2362 specifically affects the Moodle blog implementation in Internet Explorer; other browsers are not impacted by this vulnerability.