CVE-2014-9059: XSS
lib/setup.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide charset information in HTTP headers, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via UTF-7 characters during interaction with AJAX scripts.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9059?
CVE-2014-9059 has a medium severity level due to its potential for allowing cross-site scripting (XSS) attacks.
How do I fix CVE-2014-9059?
To fix CVE-2014-9059, upgrade to Moodle version 2.7.3 or later, 2.6.6 or later, or 2.5.9.
Which versions of Moodle are affected by CVE-2014-9059?
Moodle versions through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 are affected by CVE-2014-9059.
What type of vulnerability is CVE-2014-9059?
CVE-2014-9059 is a cross-site scripting (XSS) vulnerability due to improper handling of charset information in HTTP headers.
What can attackers exploit in CVE-2014-9059?
Attackers can exploit CVE-2014-9059 to inject UTF-7 characters during interactions with AJAX scripts to execute XSS attacks.