CVE-2010-1618

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in packagist/moodle/moodle

Identifiers

GHSA-45ch-hxgr-vx8j, CVE-2010-1618

Package Slug

packagist/moodle/moodle

Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Description

Cross-site scripting (XSS) vulnerability in the phpCAS client library before 1.1.0, as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, which is not properly handled in an error message.

Affected Versions

All versions starting from 1.8.0 before 1.8.12, all versions starting from 1.9.0 before 1.9.8

Solution

Upgrade to versions 1.8.12, 1.9.8 or above.

Last Modified

2024-02-09

source