Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2009-0502

Overview

Vulnerability Score 4.3 4.3
CVE Id CVE-2009-0502
Last Modified 12 Sep 2011 11:00:25
Published 09 Feb 2009 09:30:00
Confidentiality Impact NONE NONE
Integrity Impact PARTIAL PARTIAL
Availability Impact NONE NONE
Access Vector NETWORK
Access Complexity MEDIUM
Authentication NONE

CVE-2009-0502

Summary

Cross-site scripting (XSS) vulnerability in blocks/html/block_html.php in Snoopy 1.2.3, as used in Moodle 1.6 before 1.6.9, 1.7 before 1.7.7, 1.8 before 1.8.8, and 1.9 before 1.9.4, allows remote attackers to inject arbitrary web script or HTML via an HTML block, which is not properly handled when the "Login as" feature is used to visit a MyMoodle or Blog page.

Vulnerable Systems

Application

  • Moodle 1.7

  • Moodle 1.7.1

  • Moodle 1.7.2

  • Moodle 1.7.3

  • Moodle 1.7.4

  • Moodle 1.7.5

  • Moodle 1.7.6

  • Moodle 1.8

  • Moodle 1.8.1

  • Moodle 1.8.2

  • Moodle 1.8.3

  • Moodle 1.8.4

  • Moodle 1.8.5

  • Moodle 1.8.6

  • Moodle 1.8.7

  • Moodle 1.9

  • Moodle 1.9.1

  • Moodle 1.9.2

  • Moodle 1.9.3

  • Snoopy 1.2.3


References

MLIST - [oss-security] 20090204 CVS request - Moodle

DEBIAN - DSA-1724

SECUNIA - 34418

SECUNIA - 33955

CONFIRM - http://moodle.org/security/

SUSE - SUSE-SR:2009:007


Last Updated: 27 May 2016 10:50:16