Cross-site scripting in Moodle - CVE-2014-3548
Published: July 29, 2014 / Updated: January 16, 2023
Vulnerability identifier: #VU41445
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-3548
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
Vulnerability allows a remote attacker to perform Cross-site scripting attacks.
An input validation error exists in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 when processing vectors that trigger an AJAX exception dialog. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Affected software
Moodle
Fedora
moodle
Fedora
moodle
How to mitigate CVE-2014-3548
Install update from vendor's website.
Moodle - addressed in versions 2.4.11, 2.5.7, 2.6.4, 2.7.1
moodle - update to 2.4.11-1.el6
moodle - update to 2.4.11-1.el6