Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field.
| Version | Base score | Base severity | Vector |
|---|
| Hyperlink | Resource Type |
|---|
Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://openwall.com/lists/oss-security/2014/07/21/1 | mailing-list x_refsource_MLIST |
| http://osandamalith.wordpress.com/2014/07/25/moodle-2-7-persistent-xss/ | x_refsource_MISC |
| http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45683 | x_refsource_CONFIRM |
| http://packetstormsecurity.com/files/127624/Moodle-2.7-Cross-Site-Scripting.html | x_refsource_MISC |
| http://www.exploit-db.com/exploits/34169 | exploit x_refsource_EXPLOIT-DB |
| http://osvdb.org/show/osvdb/109337 | vdb-entry x_refsource_OSVDB |
| http://www.securityfocus.com/bid/68756 | vdb-entry x_refsource_BID |
| https://github.com/moodle/moodle/commit/ce5a785b0962c3c94c7a7b0d36176482d21db95d | x_refsource_CONFIRM |
| https://moodle.org/mod/forum/discuss.php?d=264265 | x_refsource_CONFIRM |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://openwall.com/lists/oss-security/2014/07/21/1 | mailing-list x_refsource_MLIST x_transferred |
| http://osandamalith.wordpress.com/2014/07/25/moodle-2-7-persistent-xss/ | x_refsource_MISC x_transferred |
| http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45683 | x_refsource_CONFIRM x_transferred |
| http://packetstormsecurity.com/files/127624/Moodle-2.7-Cross-Site-Scripting.html | x_refsource_MISC x_transferred |
| http://www.exploit-db.com/exploits/34169 | exploit x_refsource_EXPLOIT-DB x_transferred |
| http://osvdb.org/show/osvdb/109337 | vdb-entry x_refsource_OSVDB x_transferred |
| http://www.securityfocus.com/bid/68756 | vdb-entry x_refsource_BID x_transferred |
| https://github.com/moodle/moodle/commit/ce5a785b0962c3c94c7a7b0d36176482d21db95d | x_refsource_CONFIRM x_transferred |
| https://moodle.org/mod/forum/discuss.php?d=264265 | x_refsource_CONFIRM x_transferred |
Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 2.0 | 3.5 | LOW | AV:N/AC:M/Au:S/C:N/I:P/A:N |