CVE-2018-14631: XSS
moodle before versions 3.5.2, 3.4.5, 3.3.8 is vulnerable to a boost theme - blog search GET parameter insufficiently filtered. The breadcrumb navigation provided by Boost theme when displaying search results of a blog were insufficiently filtered, which could result in reflected XSS if a user followed a malicious link containing JavaScript in the search parameter.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-14631?
CVE-2018-14631 is classified as a medium severity vulnerability due to the risk of reflected XSS attacks.
How do I fix CVE-2018-14631?
To fix CVE-2018-14631, upgrade to Moodle versions 3.5.2, 3.4.5, or 3.3.8 or later.
What versions of Moodle are affected by CVE-2018-14631?
CVE-2018-14631 affects Moodle versions prior to 3.5.2, 3.4.5, and 3.3.8.
What kind of attack does CVE-2018-14631 enable?
CVE-2018-14631 enables reflected cross-site scripting (XSS) attacks through insufficiently filtered GET parameters.
Where can I find more information about CVE-2018-14631?
You can find more information about CVE-2018-14631 in the official Moodle security announcements or related security advisories.