CVE-2018-14631

Опубликовано: 17 сент. 2018

Источник: nvd

CVSS3: 8.8

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

moodle before versions 3.5.2, 3.4.5, 3.3.8 is vulnerable to a boost theme - blog search GET parameter insufficiently filtered. The breadcrumb navigation provided by Boost theme when displaying search results of a blog were insufficiently filtered, which could result in reflected XSS if a user followed a malicious link containing JavaScript in the search parameter.

Ссылки

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-62857
Patch
Vendor Advisory
http://www.securityfocus.com/bid/105371
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14631
Issue Tracking
Patch
Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=376025
Patch
Vendor Advisory
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-62857
Patch
Vendor Advisory
http://www.securityfocus.com/bid/105371
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14631
Issue Tracking
Patch
Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=376025
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*

Версия от 3.3.0 (включая) до 3.3.8 (исключая)

cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*

Версия от 3.4.0 (включая) до 3.4.5 (исключая)

cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*

Версия от 3.5.0 (включая) до 3.5.2 (исключая)

EPSS

Процентиль: 72%

0.00739

Низкий

8.8 High

CVSS3

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-20

CWE-79

Связанные уязвимости

CVE-2018-14631

CVSS3: 8.8

ubuntu

почти 7 лет назад

CVE-2018-14631

CVSS3: 8.8

debian

почти 7 лет назад

moodle before versions 3.5.2, 3.4.5, 3.3.8 is vulnerable to a boost th ...

GHSA-gqrp-qhv8-phrv

CVSS3: 6.1

github

около 3 лет назад

Moodle Cross-site Scripting

EPSS

Процентиль: 72%

0.00739

Низкий

8.8 High

CVSS3

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-20

CWE-79