The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input.
Advisories
Source ID Title
Debian DSA Debian DSA DSA-2115-1 New moodle packages fix several vulnerabilities
Debian DSA Debian DSA DSA-2115-2 New moodle packages fix several vulnerabilities
EUVD EUVD EUVD-2022-2179 The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input.
Github GHSA Github GHSA GHSA-3gm8-32vv-q8mp Moodle Cross-site Scripting vulnerability in the KSES text cleaning filter
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2024-08-07T02:25:07.388Z

Reserved: 2010-06-09T00:00:00

Link: CVE-2010-2230

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2010-06-28T17:30:01.247

Modified: 2025-04-11T00:51:21.963

Link: CVE-2010-2230

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses