CVE-2015-2269

2015-06-0119:59:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2015-2269

xss

moodle

web script injection

html injection

nvd

5.1 Medium

AI Score

Confidence

High

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.002 Low

EPSS

Percentile

54.8%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in lib/javascript-static.js in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) alt or (2) title attribute in an IMG element.

CPENameOperatorVersion
moodle:moodlemoodleeq2.7.1
moodle:moodlemoodleeq2.5.1
moodle:moodlemoodleeq2.8.3
moodle:moodlemoodleeq2.5.3
moodle:moodlemoodleeq2.5.7
moodle:moodlemoodleeq2.7.2
moodle:moodlemoodleeq2.6.7
moodle:moodlemoodleeq2.7.4
moodle:moodlemoodleeq2.5.5
moodle:moodlemoodleeq2.6.1

CPE	Name	Operator	Version
moodle:moodle	moodle	eq	2.7.1
moodle:moodle	moodle	eq	2.5.1
moodle:moodle	moodle	eq	2.8.3
moodle:moodle	moodle	eq	2.5.3
moodle:moodle	moodle	eq	2.5.7
moodle:moodle	moodle	eq	2.7.2
moodle:moodle	moodle	eq	2.6.7
moodle:moodle	moodle	eq	2.7.4
moodle:moodle	moodle	eq	2.5.5
moodle:moodle	moodle	eq	2.6.1