CVE-2016-2152: XSS
Published May 22, 2016
·Updated
Multiple cross-site scripting (XSS) vulnerabilities in auth/db/auth.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via an external DB profile field.
Affected Software
37 affected componentsFixes available
composer/moodle/moodle>=3.0<3.0.3
3.0.3
composer/moodle/moodle>=2.9<2.9.5
2.9.5
composer/moodle/moodle>=2.8<2.8.11
2.8.11
composer/moodle/moodle>=2.7<2.7.13
2.7.13
Moodle moodle<=2.6.11
Moodle moodle=2.7.0
Moodle moodle=2.7.1
Moodle moodle=2.7.2
Moodle moodle=2.7.3
Moodle moodle=2.7.4
Moodle moodle=2.7.5
Moodle moodle=2.7.6
Moodle moodle=2.7.7
Moodle moodle=2.7.8
Moodle moodle=2.7.9
Moodle moodle=2.7.10
Moodle moodle=2.7.11
Moodle moodle=2.7.12
Moodle moodle=2.8.0
Moodle moodle=2.8.1
Moodle moodle=2.8.2
Moodle moodle=2.8.3
Moodle moodle=2.8.4
Moodle moodle=2.8.5
Moodle moodle=2.8.6
Moodle moodle=2.8.7
Moodle moodle=2.8.8
Moodle moodle=2.8.9
Moodle moodle=2.8.10
Moodle moodle=2.9.0
Moodle moodle=2.9.1
Moodle moodle=2.9.2
Moodle moodle=2.9.3
Moodle moodle=2.9.4
Moodle moodle=3.0.0
Moodle moodle=3.0.1
Moodle moodle=3.0.2
Event History
May 22, 2016
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
May 13, 2022
Advisory Published
via GitHub·01:12 AM
Frequently Asked Questions
1
What is the severity of CVE-2016-2152?
CVE-2016-2152 is considered to have a medium severity due to its potential for cross-site scripting attacks.
2
How do I fix CVE-2016-2152?
To fix CVE-2016-2152, upgrade to Moodle version 2.7.13, 2.8.11, 2.9.5, or 3.0.3 or newer.
3
What versions of Moodle are affected by CVE-2016-2152?
CVE-2016-2152 affects Moodle versions up to 2.6.11 and various versions from 2.7.0 to 3.0.2.
4
Is CVE-2016-2152 exploitable remotely?
Yes, CVE-2016-2152 allows remote attackers to exploit the vulnerability via external DB profile fields.
5
What type of vulnerability is CVE-2016-2152 classified as?
CVE-2016-2152 is classified as a cross-site scripting (XSS) vulnerability.