ghsa-gqrp-qhv8-phrv
Vulnerability from github
Published
2022-05-13 01:34
Modified
2024-04-24 17:29
Severity ?
Summary
Moodle Cross-site Scripting
Details
moodle before versions 3.5.2, 3.4.5, 3.3.8 is vulnerable to a boost theme - blog search GET parameter insufficiently filtered. The breadcrumb navigation provided by Boost theme when displaying search results of a blog were insufficiently filtered, which could result in reflected XSS if a user followed a malicious link containing JavaScript in the search parameter.
{ affected: [ { package: { ecosystem: "Packagist", name: "moodle/moodle", }, ranges: [ { events: [ { introduced: "3.3", }, { fixed: "3.3.8", }, ], type: "ECOSYSTEM", }, ], }, { package: { ecosystem: "Packagist", name: "moodle/moodle", }, ranges: [ { events: [ { introduced: "3.4", }, { fixed: "3.4.5", }, ], type: "ECOSYSTEM", }, ], }, { package: { ecosystem: "Packagist", name: "moodle/moodle", }, ranges: [ { events: [ { introduced: "3.5", }, { fixed: "3.5.2", }, ], type: "ECOSYSTEM", }, ], }, ], aliases: [ "CVE-2018-14631", ], database_specific: { cwe_ids: [ "CWE-79", ], github_reviewed: true, github_reviewed_at: "2024-04-24T17:29:57Z", nvd_published_at: "2018-09-17T20:29:00Z", severity: "MODERATE", }, details: "moodle before versions 3.5.2, 3.4.5, 3.3.8 is vulnerable to a boost theme - blog search GET parameter insufficiently filtered. The breadcrumb navigation provided by Boost theme when displaying search results of a blog were insufficiently filtered, which could result in reflected XSS if a user followed a malicious link containing JavaScript in the search parameter.", id: "GHSA-gqrp-qhv8-phrv", modified: "2024-04-24T17:29:57Z", published: "2022-05-13T01:34:31Z", references: [ { type: "ADVISORY", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-14631", }, { type: "WEB", url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14631", }, { type: "PACKAGE", url: "https://github.com/moodle/moodle", }, { type: "WEB", url: "https://moodle.org/mod/forum/discuss.php?d=376025", }, { type: "WEB", url: "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-62857", }, { type: "WEB", url: "http://www.securityfocus.com/bid/105371", }, ], schema_version: "1.4.0", severity: [ { score: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", type: "CVSS_V3", }, ], summary: "Moodle Cross-site Scripting", }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.