Cross-site scripting in Moodle - CVE-2015-5336
Published: February 22, 2016 / Updated: August 9, 2020
Vulnerability identifier: #VU40459
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2015-5336
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated user to read and manipulate data.
Multiple cross-site scripting (XSS) vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the student role and entering a crafted survey answer.
Affected software
Moodle
Fedora
moodle
Fedora
moodle
How to mitigate CVE-2015-5336
Install update from vendor's website.
moodle - addressed in versions 2.7.11-1.el6, 2.8.9-1.fc22, 2.9.3-1.fc23, 3.0-1.el7, 3.0.1-1.el7