Cross-site scripting (XSS) vulnerability in the tag autocomplete functionality in Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Cross-site scripting (XSS) vulnerability in the tag autocomplete functionality in Moodle 1.9.x before
    1.9.11 and 2.0.x before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via
    unspecified vectors. (CVE-2011-4278)

The remote web server hosts Moodle, an open-source course management system. Versions of Moodle 2.x prior to 2.0.2 are potentially affected by multiple vulnerabilities :

  - A cross-site scripting (XSS) vulnerability exists in the script '/tag/tag_autocomplete.php' due to lack of input validation. (MSA-11-0003 / CVE-2011-4278)

  - An information disclosure flaw exists because it does not use the 'forceloginforprofiles' setting by default for course-profiles access control, which makes it easier for remote attackers to obtain potentially sensitive information via vectors involving use of a search engine such as Google. (MSA-11-0004 / CVE-2011-4279)

  - A cross-site scripting (XSS) vulnerability affects the Spike PHPCoverage library in Moodle. (MSA-11-0005 / CVE-2011-4280)

  - Multiple cross-site request forgery (CSRF) vulnerabilities exist due to poor access control in course completion. This could allow a malicious attacker to arbitrarily mark the course as completed or active. (MSA-11-0006 / CVE-2011-4281)

  - Multiple cross-site scripting (XSS) vulnerabilities exist in the course-tags functionality. Specifically, this affects the script 'tag/coursetags_more.php' when using the parameters 'sort' or 'show'. (MSA-11-0007 / CVE-2011-4282)

  - An information disclosure flaw exists in the IMS enterprise enrollment file when placed in the course files area. Specifically, this affects the 'imsenterprise-enrol.xml' file. (MSA-11-0008 / CVE-2011-4283)

  - An information disclosure vulnerability affects the 'MyProfile' page. This could allow a remote attacker to obtain sensitive information by visiting the 'user-context' page. (MSA-11-0009 / CVE-2011-4284)

  - A security-bypass vulnerability affects the default Moodle configuration which could allow any authenticated user to delete arbitrary courses by leveraging the teacher role. (MSA-11-0010 / CVE-2011-4285)

  - Multiple cross-site scripting (XSS) vulnerabilities exist in the media-filter implementation. Specifically, this affects the 'filter/mediaplugin/filter.php' script. A remote attacker could inject arbitrary HTML or scripts via vectors involving Flash Video (FLV) and YouTube videos. (MSA-11-0011 / CVE-2011-4286)

The remote web server hosts Moodle, an open-source course management system. Versions of Moodle prior to 1.9.11 are potentially affected by multiple vulnerabilities :

  - Multiple cross-site scripting (XSS) vulnerabilities exist in the media-filter implementation. Specifically, this affects the 'filter/mediaplugin/filter.php' script. A remote attacker could inject arbitrary HTML or scripts via vectors involving Flash Video (FLV) and YouTube videos. (MSA-11-0011 / CVE-2011-4286)

  - A cross-site scripting vulnerability exists in '/tag/tag_autocomplete.php' due to lack of input validation. (MSA-11-0003 / CVE-2011-4278)

  - A cross-site request forgery vulnerability flaw exists in RSS feeds contained within an RSS block. (MSA-11-0002 / CVE-2011-4133)

  - An information disclosure flaw exists in the IMS enterprise enrollment file when placed in the course files area. Specifically, this affects the 'imsenterprise-enrol.xml' file. (MSA-11-0008 / CVE-2011-4283)

ID	Name	Product	Family	Severity
433886	SCA: security update for moodle/moodle (GHSA-6656-6qwx-4c2m)	Tenable Cloud Security	SCA Checks	medium
433886	SCA: security update for moodle/moodle (GHSA-6656-6qwx-4c2m)	Tenable Self-Hosted Container Security	SCA Checks	medium
8708	Moodle 2.0.x < 2.0.2 Multiple Vulnerabilities	Nessus Network Monitor	CGI	high
8707	Moodle 1.9.x < 1.9.11 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2011-4278

medium

Tenable Plugins

medium

medium

high

medium