CVE-2008-1502

2008-03-2500:00:00

ubuntu.com

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.006 Low

EPSS

Percentile

77.5%

JSON

The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES,
as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other
products, allows remote attackers to bypass HTML filtering and conduct
cross-site scripting (XSS) attacks via a string containing crafted URL
protocols.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471839>

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchegroupware< 1.2.107-2.dfsg-2ubuntu1UNKNOWN
ubuntu7.10noarchmoodle< 1.8.2-1ubuntu2.1UNKNOWN
ubuntu8.04noarchmoodle< 1.8.2-1ubuntu4.1UNKNOWN
ubuntu8.10noarchmoodle< 1.8.2-1ubuntu2.1UNKNOWN
ubuntu9.04noarchmoodle< 1.8.2-1ubuntu2.1UNKNOWN
ubuntu9.10noarchmoodle< 1.8.2-1ubuntu2.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	8.04	noarch	egroupware	< 1.2.107-2.dfsg-2ubuntu1	UNKNOWN
ubuntu	7.10	noarch	moodle	< 1.8.2-1ubuntu2.1	UNKNOWN
ubuntu	8.04	noarch	moodle	< 1.8.2-1ubuntu4.1	UNKNOWN
ubuntu	8.10	noarch	moodle	< 1.8.2-1ubuntu2.1	UNKNOWN
ubuntu	9.04	noarch	moodle	< 1.8.2-1ubuntu2.1	UNKNOWN
ubuntu	9.10	noarch	moodle	< 1.8.2-1ubuntu2.1	UNKNOWN