CVE-2012-2364
Published: 21 July 2012
Cross-site scripting (XSS) vulnerability in lib/filelib.php in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via an assignment submission with zip compression, leading to text/html rendering during a "download all" action.
Notes
Author | Note |
---|---|
jdstrand | moodle 2.0 and higher |
Priority
Status
Package | Release | Status |
---|---|---|
moodle Launchpad, Ubuntu, Debian |
vivid |
Ignored
(end of life)
|
artful |
Ignored
(end of life)
|
|
bionic |
Not vulnerable
(2.5.4-1ubuntu1)
|
|
cosmic |
Not vulnerable
(2.5.4-1ubuntu1)
|
|
hardy |
Ignored
(end of life)
|
|
lucid |
Not vulnerable
|
|
natty |
Not vulnerable
|
|
oneiric |
Not vulnerable
|
|
precise |
Not vulnerable
(1.9.9.dfsg2-6)
|
|
quantal |
Ignored
(end of life)
|
|
raring |
Ignored
(end of life)
|
|
saucy |
Ignored
(end of life)
|
|
trusty |
Does not exist
(trusty was not-affected [2.5.4-1ubuntu1])
|
|
upstream |
Released
(2.2.3.dfsg-1)
|
|
utopic |
Ignored
(end of life)
|
|
wily |
Ignored
(end of life)
|
|
xenial |
Not vulnerable
(2.5.4-1ubuntu1)
|
|
yakkety |
Ignored
(end of life)
|
|
zesty |
Ignored
(end of life)
|
|
Patches: other: http://git.moodle.org/gw?p=moodle.git;a=commit;h=ce4126c7a9e07dd0514f7ac297b5e60cad0b8d20 |