Moodle CVE-2014-3549 Cross Site Scripting Vulnerability

Bugtraq ID:	68761
Class:	Input Validation Error
CVE:	CVE-2014-3549
Remote:	Yes
Local:	No
Published:	Jul 21 2014 12:00AM
Updated:	Apr 16 2015 06:13PM
Credit:	Skylar Kelty
Vulnerable:
Not Vulnerable:

Moodle CVE-2014-3549 Cross Site Scripting Vulnerability

Moodle is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Moodle 2.7 is vulnerable; other versions may also be affected.

Moodle CVE-2014-3549 Cross Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Moodle CVE-2014-3549 Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Moodle CVE-2014-3549 Cross Site Scripting Vulnerability

References:

• MDL-46201 events: Sanitization of username before returning the description. (Moodle)
  
• Moodle Homepage (Moodle)
  
• MSA-14-0030: Cross-site scripting through logs of failed logins (Moodle)