CVE-2014-3547: XSS
Published Jul 29, 2014
·Updated
Multiple cross-site scripting (XSS) vulnerabilities in badges/renderer.php in Moodle 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via an external badge.
Affected Software
15 affected componentsFixes available
composer/moodle/moodle>=2.7.0<2.7.1
2.7.1
composer/moodle/moodle>=2.6.0<2.6.4
2.6.4
composer/moodle/moodle>=2.5.0<2.5.7
2.5.7
Moodle moodle=2.5.0
Moodle moodle=2.5.1
Moodle moodle=2.5.2
Moodle moodle=2.5.3
Moodle moodle=2.5.4
Moodle moodle=2.5.5
Moodle moodle=2.5.6
Moodle moodle=2.6.0
Moodle moodle=2.6.1
Moodle moodle=2.6.2
Moodle moodle=2.6.3
Moodle moodle=2.7.0
Remediation
Event History
Jul 29, 2014
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
May 13, 2022
Advisory Published
via GitHub·01:12 AM
Frequently Asked Questions
1
What is the severity of CVE-2014-3547?
CVE-2014-3547 is categorized as a medium severity vulnerability due to its potential for cross-site scripting attacks.
2
How do I fix CVE-2014-3547?
To fix CVE-2014-3547, upgrade Moodle to version 2.5.7, 2.6.4, or 2.7.1 or later.
3
What are the potential impacts of CVE-2014-3547?
The potential impacts of CVE-2014-3547 include unauthorized execution of scripts and the possibility of data theft or account compromise.
4
Which versions of Moodle are affected by CVE-2014-3547?
CVE-2014-3547 affects Moodle versions 2.5.0 to 2.5.6, 2.6.0 to 2.6.3, and 2.7.0.
5
Is CVE-2014-3547 an easily exploitable vulnerability?
Yes, CVE-2014-3547 can be easily exploited by attackers to inject arbitrary web scripts or HTML.