CVE-2015-0212: Moodle cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in course/pending.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted course summary.
Other sources
Moodle cross-site scripting (XSS) vulnerability
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.8.2 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.7.4 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.6.7
Event History
Frequently Asked Questions
What is the severity of CVE-2015-0212?
CVE-2015-0212 has a medium severity rating, allowing for cross-site scripting attacks.
How do I fix CVE-2015-0212?
To fix CVE-2015-0212, upgrade Moodle to version 2.8.2, 2.7.4, or 2.6.7 or later.
What versions of Moodle are affected by CVE-2015-0212?
CVE-2015-0212 affects Moodle versions from 2.5.0 up to 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2.
What type of vulnerability is CVE-2015-0212?
CVE-2015-0212 is classified as a cross-site scripting (XSS) vulnerability.
Can CVE-2015-0212 be exploited by unauthenticated users?
No, CVE-2015-0212 can only be exploited by remote authenticated users.