CVE-2016-2152: Moodle XSS from profile fields from external db
Moodle XSS from profile fields from external db
Other sources
Multiple cross-site scripting (XSS) vulnerabilities in auth/db/auth.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via an external DB profile field.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.0.3 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.9.5 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.8.11 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.7.13
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2152?
CVE-2016-2152 is considered to have a medium severity due to its potential for cross-site scripting attacks.
How do I fix CVE-2016-2152?
To fix CVE-2016-2152, upgrade to Moodle version 2.7.13, 2.8.11, 2.9.5, or 3.0.3 or newer.
What versions of Moodle are affected by CVE-2016-2152?
CVE-2016-2152 affects Moodle versions up to 2.6.11 and various versions from 2.7.0 to 3.0.2.
Is CVE-2016-2152 exploitable remotely?
Yes, CVE-2016-2152 allows remote attackers to exploit the vulnerability via external DB profile fields.
What type of vulnerability is CVE-2016-2152 classified as?
CVE-2016-2152 is classified as a cross-site scripting (XSS) vulnerability.