CVE-2017-12156: XSS
Published Sep 18, 2017
·Updated
Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback.
Affected Software
46 affected componentsFixes available
composer/moodle/moodle<=3.1.7
3.1.8
composer/moodle/moodle>=3.2.0<=3.2.4
3.2.5
composer/moodle/moodle>=3.3.0<=3.3.1
3.3.2
Moodle moodle=3.0.0
Moodle moodle=3.0.0-beta
Moodle moodle=3.0.0-rc1
Moodle moodle=3.0.0-rc2
Moodle moodle=3.0.0-rc3
Moodle moodle=3.0.0-rc4
Moodle moodle=3.0.1
Moodle moodle=3.0.2
Moodle moodle=3.0.3
Moodle moodle=3.0.4
Moodle moodle=3.0.5
Moodle moodle=3.0.6
Moodle moodle=3.0.7
Moodle moodle=3.0.8
Moodle moodle=3.0.9
Moodle moodle=3.0.10
Moodle moodle=3.1.0
Moodle moodle=3.1.0-beta
Moodle moodle=3.1.0-rc1
Moodle moodle=3.1.0-rc2
Moodle moodle=3.1.1
Moodle moodle=3.1.2
Moodle moodle=3.1.3
Moodle moodle=3.1.4
Moodle moodle=3.1.5
Moodle moodle=3.1.6
Moodle moodle=3.1.7
Moodle moodle=3.1.8
Moodle moodle=3.2.0
Moodle moodle=3.2.0-beta
Moodle moodle=3.2.0-rc1
Moodle moodle=3.2.0-rc2
Moodle moodle=3.2.0-rc3
Moodle moodle=3.2.0-rc4
Moodle moodle=3.2.0-rc5
Moodle moodle=3.2.1
Moodle moodle=3.2.2
Moodle moodle=3.2.3
Moodle moodle=3.2.4
Moodle moodle=3.2.5
Moodle moodle=3.3.0
Moodle moodle=3.3.1
Moodle moodle=3.3.2
Remediation
Patch Available
Event History
Sep 18, 2017
CVE Published
via MITRE·04:00 AM
Data Sourced
via MITRE·04:00 AM
DescriptionWeakness
May 17, 2022
Advisory Published
12:51 AM
Frequently Asked Questions
1
What is the severity of CVE-2017-12156?
CVE-2017-12156 is classified as a cross-site scripting (XSS) vulnerability which can potentially allow attackers to execute arbitrary scripts in the context of the user's browser.
2
How do I fix CVE-2017-12156?
To fix CVE-2017-12156, upgrade Moodle to version 3.1.8 or 3.2.5 or later, as these versions provide the necessary security patches.
3
What versions of Moodle are affected by CVE-2017-12156?
CVE-2017-12156 affects Moodle versions 3.0.0 through 3.3.1.
4
What type of attack can CVE-2017-12156 facilitate?
CVE-2017-12156 can facilitate cross-site scripting (XSS) attacks, allowing malicious users to inject scripts into web pages viewed by other users.
5
Is user input a factor in CVE-2017-12156?
Yes, the vulnerability occurs due to improper handling of user input in the contact form on the 'non-respondents' page.