Cross-site scripting (XSS) vulnerability in the Spike PHPCoverage (aka spikephpcoverage) library, as used in Moodle 2.0.x before 2.0.2 and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Cross-site scripting (XSS) vulnerability in the Spike PHPCoverage (aka spikephpcoverage) library, as used
    in Moodle 2.0.x before 2.0.2 and other products, allows remote attackers to inject arbitrary web script or
    HTML via unspecified vectors. (CVE-2011-4280)

The remote web server hosts Moodle, an open-source course management system. Versions of Moodle 2.x prior to 2.0.2 are potentially affected by multiple vulnerabilities :

  - A cross-site scripting (XSS) vulnerability exists in the script '/tag/tag_autocomplete.php' due to lack of input validation. (MSA-11-0003 / CVE-2011-4278)

  - An information disclosure flaw exists because it does not use the 'forceloginforprofiles' setting by default for course-profiles access control, which makes it easier for remote attackers to obtain potentially sensitive information via vectors involving use of a search engine such as Google. (MSA-11-0004 / CVE-2011-4279)

  - A cross-site scripting (XSS) vulnerability affects the Spike PHPCoverage library in Moodle. (MSA-11-0005 / CVE-2011-4280)

  - Multiple cross-site request forgery (CSRF) vulnerabilities exist due to poor access control in course completion. This could allow a malicious attacker to arbitrarily mark the course as completed or active. (MSA-11-0006 / CVE-2011-4281)

  - Multiple cross-site scripting (XSS) vulnerabilities exist in the course-tags functionality. Specifically, this affects the script 'tag/coursetags_more.php' when using the parameters 'sort' or 'show'. (MSA-11-0007 / CVE-2011-4282)

  - An information disclosure flaw exists in the IMS enterprise enrollment file when placed in the course files area. Specifically, this affects the 'imsenterprise-enrol.xml' file. (MSA-11-0008 / CVE-2011-4283)

  - An information disclosure vulnerability affects the 'MyProfile' page. This could allow a remote attacker to obtain sensitive information by visiting the 'user-context' page. (MSA-11-0009 / CVE-2011-4284)

  - A security-bypass vulnerability affects the default Moodle configuration which could allow any authenticated user to delete arbitrary courses by leveraging the teacher role. (MSA-11-0010 / CVE-2011-4285)

  - Multiple cross-site scripting (XSS) vulnerabilities exist in the media-filter implementation. Specifically, this affects the 'filter/mediaplugin/filter.php' script. A remote attacker could inject arbitrary HTML or scripts via vectors involving Flash Video (FLV) and YouTube videos. (MSA-11-0011 / CVE-2011-4286)

ID	Name	Product	Family	Severity
432449	SCA: security update for moodle/moodle (GHSA-mx5g-3vxh-rgm8)	Tenable Cloud Security	SCA Checks	medium
432449	SCA: security update for moodle/moodle (GHSA-mx5g-3vxh-rgm8)	Tenable Self-Hosted Container Security	SCA Checks	medium
8708	Moodle 2.0.x < 2.0.2 Multiple Vulnerabilities	Nessus Network Monitor	CGI	high

Detections

Analytics

CVE-2011-4280

medium

Tenable Plugins

medium

medium

high