CVE-2016-0725: Moodle Cross-site scripting (XSS) vulnerability in course management search
Cross-site scripting (XSS) vulnerability in the searchpagination function in course/classes/managementrenderer.php in Moodle 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted search string.
Other sources
Moodle Cross-site scripting (XSS) vulnerability in course management search
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.0.2 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.9.4 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.8.10
Event History
Frequently Asked Questions
What is the severity of CVE-2016-0725?
CVE-2016-0725 has been classified as a high severity cross-site scripting (XSS) vulnerability.
How do I fix CVE-2016-0725?
To fix CVE-2016-0725, upgrade Moodle to version 2.8.10, 2.9.4, or 3.0.2 or later.
Which versions of Moodle are affected by CVE-2016-0725?
CVE-2016-0725 affects Moodle versions 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2.
Can CVE-2016-0725 be exploited by remote attackers?
Yes, CVE-2016-0725 allows remote attackers to inject arbitrary web scripts or HTML via a crafted search string.
In which component of Moodle does CVE-2016-0725 occur?
CVE-2016-0725 occurs in the search_pagination function within course/classes/management_renderer.php.