Описание
Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly restrict the availability of Flowplayer, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted .swf file.
| Релиз | Статус | Примечание |
|---|---|---|
| artful | not-affected | 2.7.11+dfsg-2 |
| bionic | not-affected | 2.7.11+dfsg-2 |
| cosmic | not-affected | 2.7.11+dfsg-2 |
| devel | not-affected | 2.7.11+dfsg-2 |
| disco | not-affected | 2.7.11+dfsg-2 |
| esm-apps-legacy/xenial | not-affected | 2.7.11+dfsg-2 |
| esm-apps/bionic | not-affected | 2.7.11+dfsg-2 |
| esm-apps/xenial | not-affected | 2.7.11+dfsg-2 |
| esm-infra-legacy/trusty | DNE | trusty/esm was DNE [trusty was needed] |
| precise | ignored | end of life |
Показывать по
EPSS
4.3 Medium
CVSS2
6.1 Medium
CVSS3
Связанные уязвимости
Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly restrict the availability of Flowplayer, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted .swf file.
Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2. ...
Уязвимость системы управления обучением Мoodle, позволяющая нарушителю провести XSS-атаки
EPSS
4.3 Medium
CVSS2
6.1 Medium
CVSS3