CVE-2017-2644: XSS
Published Mar 26, 2017
·Updated
In Moodle 3.x, XSS can occur via evidence of prior learning.
Affected Software
18 affected componentsFixes available
composer/moodle/moodle>=3.1.0<=3.1.4
3.1.5
composer/moodle/moodle>=3.2.0<=3.2.1
3.2.2
Moodle moodle=3.1.0
Moodle moodle=3.1.0-beta
Moodle moodle=3.1.0-rc1
Moodle moodle=3.1.0-rc2
Moodle moodle=3.1.1
Moodle moodle=3.1.2
Moodle moodle=3.1.3
Moodle moodle=3.1.4
Moodle moodle=3.2.0
Moodle moodle=3.2.0-beta
Moodle moodle=3.2.0-rc1
Moodle moodle=3.2.0-rc2
Moodle moodle=3.2.0-rc3
Moodle moodle=3.2.0-rc4
Moodle moodle=3.2.0-rc5
Moodle moodle=3.2.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.1.5 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.2.2
Event History
Mar 26, 2017
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
DescriptionWeakness
Data Sourced
via NVD·06:59 PM
RemedyDescriptionSeverityWeaknessAffected Software
May 17, 2022
Advisory Published
02:30 AM
Frequently Asked Questions
1
What is the severity of CVE-2017-2644?
CVE-2017-2644 has a medium severity rating due to the potential for cross-site scripting (XSS) attacks.
2
How do I fix CVE-2017-2644?
To fix CVE-2017-2644, update your Moodle installation to the latest version that includes patches for this vulnerability.
3
What versions of Moodle are affected by CVE-2017-2644?
CVE-2017-2644 affects Moodle versions 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.2.0, and 3.2.1.
4
Can I mitigate CVE-2017-2644 without updating?
Mitigation for CVE-2017-2644 is limited; the best action is to update to a secure version.
5
What type of vulnerability is CVE-2017-2644?
CVE-2017-2644 is a cross-site scripting (XSS) vulnerability.