Description
Cross-site scripting (XSS) vulnerability in the search_pagination function in course/classes/management_renderer.php in Moodle 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted search string.
References (6)
Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1034694
Patch x_refsource_confirm
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52552
Vendor Advisory x_refsource_confirm
https://moodle.org/mod/forum/discuss.php?d=326206
Mailing List mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/01/18/1
Third Party Advisory vendor-advisory
x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176502.html
Third Party Advisory vendor-advisory
x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176436.html
Scores
CVSS v3
6.1
EPSS
0.0060
EPSS Percentile
69.6%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (19)
fedoraproject/fedora
22
fedoraproject/fedora
23
moodle/moodle
2.8.0
moodle/moodle
2.8.1
moodle/moodle
2.8.2
moodle/moodle
2.8.3
moodle/moodle
2.8.4
moodle/moodle
2.8.5
moodle/moodle
2.8.6
moodle/moodle
2.8.7
... and 9 more
Published
Feb 22, 2016
Tracked Since
Feb 18, 2026