XSS Vulnerability in Moodle Calendar Event Name by Moodle
CVE-2018-1045

5.4MEDIUM

Key Information:

Vendor

Moodle
Status
Moodle 3.x
Vendor
CVE Published:
22 January 2018

What is CVE-2018-1045?

In Moodle versions 3.x, an XSS vulnerability exists that can be exploited through the manipulation of calendar event names. Attackers can inject malicious scripts, potentially compromising user data and sessions. Users should ensure their Moodle installations are regularly updated and apply necessary security patches to mitigate risks associated with this vulnerability.

Affected Version(s)

Moodle 3.x Moodle 3.x

References

https://moodle.org/mod/forum/discuss.php?d=364384
x_refsource_CONFIRM
http://www.securityfocus.com/bid/102755
vdb-entryx_refsource_BID

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.