CVE-2012-2365: XSS
Published Jul 21, 2012
·Updated
Cross-site scripting (XSS) vulnerability in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via the idnumber field to cohort/edit.php.
Affected Software
18 affected components
Moodle moodle=2.0.0
Moodle moodle=2.0.1
Moodle moodle=2.0.2
Moodle moodle=2.0.3
Moodle moodle=2.0.4
Moodle moodle=2.0.5
Moodle moodle=2.0.6
Moodle moodle=2.0.7
Moodle moodle=2.0.8
Moodle moodle=2.1.0
Moodle moodle=2.1.1
Moodle moodle=2.1.2
Moodle moodle=2.1.3
Moodle moodle=2.1.4
Moodle moodle=2.1.5
Moodle moodle=2.2.0
Moodle moodle=2.2.1
Moodle moodle=2.2.2
Event History
Jul 21, 2012
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-2365?
CVE-2012-2365 has a medium severity rating due to potential exploitation through cross-site scripting.
2
How do I fix CVE-2012-2365?
To resolve CVE-2012-2365, upgrade Moodle to version 2.0.9 or later, 2.1.6 or later, or 2.2.3 or later.
3
Which versions of Moodle are affected by CVE-2012-2365?
CVE-2012-2365 affects Moodle versions 2.0.x prior to 2.0.9, 2.1.x prior to 2.1.6, and 2.2.x prior to 2.2.3.
4
What type of vulnerability is CVE-2012-2365?
CVE-2012-2365 is classified as a cross-site scripting (XSS) vulnerability.
5
Who can exploit CVE-2012-2365?
CVE-2012-2365 can be exploited by remote authenticated users who access the cohort/edit.php page.