CVE-2015-5337: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

May 13, 2022 (updated August 10, 2023)

Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly restrict the availability of Flowplayer, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted .swf file.

References

git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48085
github.com/advisories/GHSA-2hw6-6rgf-726v
github.com/moodle/moodle/commit/c73f6d03e5037729097bb9f5f5a55be15f3cab18
moodle.org/mod/forum/discuss.php?d=323232
nvd.nist.gov/vuln/detail/CVE-2015-5337

Detect and mitigate CVE-2015-5337 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →