GHSA-89f3-74m6-g27g

Source

https://github.com/advisories/GHSA-89f3-74m6-g27g

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-89f3-74m6-g27g/GHSA-89f3-74m6-g27g.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-89f3-74m6-g27g

Aliases

CVE-2013-1833

Published

2022-05-13T01:12:59Z

Modified

2024-12-05T05:40:35.273670Z

Summary

Moodle Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module

Details

Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted filename.

Database specific

{
    "nvd_published_at": "2013-03-25T21:55:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-17T22:18:44Z"
}

References

Affected packages

Packagist / moodle/moodle

Package

Name: moodle/moodle
Purl: pkg:composer/moodle/moodle

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0.0

Last affected

2.1.10

Packagist / moodle/moodle

Package

Name: moodle/moodle
Purl: pkg:composer/moodle/moodle

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.2.0

Fixed

2.2.8

Packagist / moodle/moodle

Package

Name: moodle/moodle
Purl: pkg:composer/moodle/moodle

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.3.0

Fixed

2.3.5

Affected versions

v2.*

v2.3.4

Packagist / moodle/moodle

Package

Name: moodle/moodle
Purl: pkg:composer/moodle/moodle

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.4.0

Fixed

2.4.2

Affected versions

v2.*

v2.4.0

v2.4.1