CVE-2009-0502

2009-02-1002:30:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2009-0502

cross-site scripting

xss vulnerability

snoopy

moodle

html block

remote attackers

web script

5.4 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

65.6%

JSON

Cross-site scripting (XSS) vulnerability in blocks/html/block_html.php in Snoopy 1.2.3, as used in Moodle 1.6 before 1.6.9, 1.7 before 1.7.7, 1.8 before 1.8.8, and 1.9 before 1.9.4, allows remote attackers to inject arbitrary web script or HTML via an HTML block, which is not properly handled when the “Login as” feature is used to visit a MyMoodle or Blog page.

CPENameOperatorVersion
snoopy:snoopysnoopyeq1.2.3
moodle:moodlemoodleeq1.7.0
moodle:moodlemoodleeq1.7.1
moodle:moodlemoodleeq1.7.2
moodle:moodlemoodleeq1.7.3
moodle:moodlemoodleeq1.7.4
moodle:moodlemoodleeq1.7.5
moodle:moodlemoodleeq1.7.6
moodle:moodlemoodleeq1.8.1
moodle:moodlemoodleeq1.8.2

CPE	Name	Operator	Version
snoopy:snoopy	snoopy	eq	1.2.3
moodle:moodle	moodle	eq	1.7.0
moodle:moodle	moodle	eq	1.7.1
moodle:moodle	moodle	eq	1.7.2
moodle:moodle	moodle	eq	1.7.3
moodle:moodle	moodle	eq	1.7.4
moodle:moodle	moodle	eq	1.7.5
moodle:moodle	moodle	eq	1.7.6
moodle:moodle	moodle	eq	1.8.1
moodle:moodle	moodle	eq	1.8.2