CVE-2014-7835: XSS
webservice/upload.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not ensure that a file upload is for a private or draft area, which allows remote authenticated users to upload files containing JavaScript, and consequently conduct cross-site scripting (XSS) attacks, by specifying the profile-picture area.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-7835?
CVE-2014-7835 is considered to have a medium severity due to the potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2014-7835?
To mitigate CVE-2014-7835, update your Moodle software to version 2.6.6 or later, or 2.7.3 or later.
Who is affected by CVE-2014-7835?
CVE-2014-7835 affects Moodle versions 2.6.x before 2.6.6 and 2.7.x before 2.7.3.
What type of vulnerability is CVE-2014-7835?
CVE-2014-7835 is a cross-site scripting (XSS) vulnerability due to improper file upload handling.
Can remote users exploit CVE-2014-7835?
Yes, remote authenticated users can exploit CVE-2014-7835 to upload malicious JavaScript files.