CVE-2014-9059: Moodle does not provide charset information in HTTP headers
lib/setup.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide charset information in HTTP headers, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via UTF-7 characters during interaction with AJAX scripts.
Other sources
Moodle does not provide charset information in HTTP headers
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.7.3 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.6.6 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.5.9
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9059?
CVE-2014-9059 has a medium severity level due to its potential for allowing cross-site scripting (XSS) attacks.
How do I fix CVE-2014-9059?
To fix CVE-2014-9059, upgrade to Moodle version 2.7.3 or later, 2.6.6 or later, or 2.5.9.
Which versions of Moodle are affected by CVE-2014-9059?
Moodle versions through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 are affected by CVE-2014-9059.
What type of vulnerability is CVE-2014-9059?
CVE-2014-9059 is a cross-site scripting (XSS) vulnerability due to improper handling of charset information in HTTP headers.
What can attackers exploit in CVE-2014-9059?
Attackers can exploit CVE-2014-9059 to inject UTF-7 characters during interactions with AJAX scripts to execute XSS attacks.