GHSA-hhxf-w8hj-43w6

Source

https://github.com/advisories/GHSA-hhxf-w8hj-43w6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-hhxf-w8hj-43w6/GHSA-hhxf-w8hj-43w6.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hhxf-w8hj-43w6

Aliases

CVE-2010-1619

Published

2022-05-13T01:13:08Z

Modified

2025-04-11T20:14:21.271930Z

Severity

1.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U CVSS Calculator

Summary

Moodle vulnerable to Cross-site Scripting

Details

Cross-site scripting (XSS) vulnerability in the fixnonstandard_entities function in the KSES HTML text cleaning library (weblib.php), as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via crafted HTML entities.

Database specific

{
    "nvd_published_at": "2010-04-29T21:30:00Z",
    "github_reviewed_at": "2025-04-11T20:02:58Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed": true,
    "severity": "LOW"
}

References

Affected packages

Packagist / moodle/moodle

Package

Name: moodle/moodle
Purl: pkg:composer/moodle/moodle

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.8.0

Fixed

1.8.12

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-hhxf-w8hj-43w6/GHSA-hhxf-w8hj-43w6.json"

Packagist / moodle/moodle

Package

Name: moodle/moodle
Purl: pkg:composer/moodle/moodle

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.9.0

Fixed

1.9.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-hhxf-w8hj-43w6/GHSA-hhxf-w8hj-43w6.json"