Cross-site scripting in Moodle - CVE-2011-4286

Vulnerability details

Vulnerability allows a remote attacker to perform XSS attacks.

The vulnerability is caused by an input validation error in the media-filter implementation in filter/mediaplugin/filter.php in Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 when processing vectors involving (1) Flash Video (aka FLV) files and (2) YouTube videos. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Affected software

How to mitigate CVE-2011-4286

External References

• http://git.moodle.org/gw?p=moodle.git;a=commit;h=8f81bfd412c6b2e93a5b15711727d5cb7cc78336
• http://moodle.org/mod/forum/discuss.php?d=170012
• http://openwall.com/lists/oss-security/2011/11/14/1

Related Security Bulletins

• Multiple vulnerabilities in Moodle