CVE-2015-5337

MEDIUM

Moodle < 2.6.11, 2.7.x < 2.7.11, 2.8.x < 2.8.9, 2.9.x < 2.9.3 - Cross-Site Scripting via Crafted SWF File

Title source: llm

Description

Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly restrict the availability of Flowplayer, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted .swf file.

References (2)

Core 2

Core References

Patch x_refsource_confirm

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48085

Vendor Advisory x_refsource_confirm

https://moodle.org/mod/forum/discuss.php?d=323232

Scores

CVSS v3 6.1

EPSS 0.0027

EPSS Percentile 50.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (25)

moodle/moodle 2.7.0

moodle/moodle 2.7.1

moodle/moodle 2.7.2

moodle/moodle 2.7.3

moodle/moodle 2.7.4

moodle/moodle 2.7.5

moodle/moodle 2.7.6

moodle/moodle 2.7.7

moodle/moodle 2.7.8

moodle/moodle 2.7.9

... and 15 more

Published Feb 22, 2016

Tracked Since Feb 18, 2026