CVE-2014-3549: XSS

Published Jul 29, 2014

Updated

Cross-site scripting (XSS) vulnerability in the getdescription function in lib/classes/event/userloginfailed.php in Moodle 2.7.x before 2.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted username that is improperly handled during the logging of an invalid login attempt.

Affected Software

1 affected component

Moodle moodle=2.7.0

Remediation

Patch Available

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-46201

Event History

Jul 29, 2014

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-3549?

CVE-2014-3549 is rated as a medium severity vulnerability due to the potential for cross-site scripting attacks.

How do I fix CVE-2014-3549?

To fix CVE-2014-3549, upgrade Moodle to version 2.7.1 or later, which addresses this vulnerability.

What impact does CVE-2014-3549 have on user security?

CVE-2014-3549 allows remote attackers to inject malicious scripts, potentially compromising user accounts and session data.

In which versions of Moodle is CVE-2014-3549 present?

CVE-2014-3549 affects Moodle versions 2.7.0 and earlier.

Can CVE-2014-3549 be exploited through a crafted username?

Yes, CVE-2014-3549 can be exploited by using a crafted username that the application fails to properly sanitize during login attempts.