CVE-2013-4341 Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 allow remote attackers to inject arbitrary web script or HT...
MediumCVSS 4.3
EPSS 21.9%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 allow remote attackers to inject arbitrary web script or HTML via a crafted blog link within an RSS feed.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| moodle/moodle | <= 2.2.11 | No fix listed |
| moodle/moodle | = 2.3.0 | No fix listed |
| moodle/moodle | = 2.3.1 | No fix listed |
| moodle/moodle | = 2.3.2 | No fix listed |
| moodle/moodle | = 2.3.3 | No fix listed |
| moodle/moodle | = 2.3.4 | No fix listed |
| moodle/moodle | = 2.3.5 | No fix listed |
| moodle/moodle | = 2.3.6 | No fix listed |
| moodle/moodle | = 2.3.7 | No fix listed |
| moodle/moodle | = 2.3.8 | No fix listed |
| moodle/moodle | = 2.4.0 | No fix listed |
| moodle/moodle | = 2.4.1 | No fix listed |
| moodle/moodle | = 2.4.2 | No fix listed |
| moodle/moodle | = 2.4.3 | No fix listed |
| moodle/moodle | = 2.4.4 | No fix listed |
| moodle/moodle | = 2.4.5 | No fix listed |
| moodle/moodle | = 2.5.0 | No fix listed |
| moodle/moodle | = 2.5.1 | No fix listed |
References
- git.moodle.org vendor-advisory
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- moodle.org vendor-advisory