Moodle CVE-2012-2364 Cross-Site Scripting Vulnerability

Bugtraq ID:	73583
Class:	Input Validation Error
CVE:	CVE-2012-2364
Remote:	Yes
Local:	No
Published:	Jul 20 2012 12:00AM
Updated:	Jul 20 2012 12:00AM
Credit:	Unknown
Vulnerable:	Moodle Moodle 2.2.2 Moodle Moodle 2.1.5 Moodle Moodle 2.1.2 Moodle Moodle 2.0.8 Moodle Moodle 2.0.5 Moodle Moodle 2.0.3 Moodle Moodle 2.2.1 Moodle Moodle 2.2 Moodle Moodle 2.1.4 Moodle Moodle 2.1.3 Moodle Moodle 2.1.1 Moodle Moodle 2.1 Moodle Moodle 2.0.7 Moodle Moodle 2.0.6 Moodle Moodle 2.0.4 Moodle Moodle 2.0.2 Moodle Moodle 2.0.1 Moodle Moodle 2.0
Not Vulnerable:

Moodle CVE-2012-2364 Cross-Site Scripting Vulnerability

Moodle is prone to a cross-site scripting vulnerability. Cross-site scripting (XSS) vulnerability in lib/filelib.php in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via an assignment submission with zip compression, leading to text/html rendering during a "download all" action.

Moodle CVE-2012-2364 Cross-Site Scripting Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or you are aware of more recent information, please mail us at: [email protected]

Moodle CVE-2012-2364 Cross-Site Scripting Vulnerability

References:

• Official Moodle git projects - moodle.git/commit (CONFIRM)
  
• oss-security - Moodle security notifications public (MLIST)