CVE-2014-3547: Moodle multiple cross-site scripting (XSS) vulnerabilities
Moodle multiple cross-site scripting (XSS) vulnerabilities
Other sources
Multiple cross-site scripting (XSS) vulnerabilities in badges/renderer.php in Moodle 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via an external badge.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.7.1 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.6.4 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.5.7
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3547?
CVE-2014-3547 is categorized as a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2014-3547?
To fix CVE-2014-3547, upgrade Moodle to version 2.5.7, 2.6.4, or 2.7.1 or later.
What are the potential impacts of CVE-2014-3547?
The potential impacts of CVE-2014-3547 include unauthorized execution of scripts and the possibility of data theft or account compromise.
Which versions of Moodle are affected by CVE-2014-3547?
CVE-2014-3547 affects Moodle versions 2.5.0 to 2.5.6, 2.6.0 to 2.6.3, and 2.7.0.
Is CVE-2014-3547 an easily exploitable vulnerability?
Yes, CVE-2014-3547 can be easily exploited by attackers to inject arbitrary web scripts or HTML.