Cross-site scripting (XSS) vulnerability in blog/edit.php in Moodle 1.6.x before 1.6.7 and 1.7.x before 1.7.5 allows remote attackers to inject arbitrary web script or HTML via the etitle parameter (blog entry title).

Moodle was prone to a Cross-Site scripting flaw which could potentially be exploited to compromise arbitrary accounts (CVE-2008-3326).

Several remote vulnerabilities have been discovered in Moodle, an online course management system. The following issues are addressed in this update, ranging from cross site scripting to remote code execution.

Various cross site scripting issues in the Moodle codebase (CVE-2008-3326, CVE-2008-3325, CVE-2007-3555, CVE-2008-5432, MSA-08-0021, MDL-8849, MDL-12793, MDL-11414, MDL-14806, MDL-10276).

Various cross site request forgery issues in the Moodle codebase (CVE-2008-3325, MSA-08-0023).

Privilege escalation bugs in the Moodle codebase (MSA-08-0001, MDL-7755).

SQL injection issue in the hotpot module (MSA-08-0010).

An embedded copy of Smarty had several vulnerabilities (CVE-2008-4811, CVE-2008-4810 ). An embedded copy of Snoopy was vulnerable to cross site scripting (CVE-2008-4796 ). An embedded copy of Kses was vulnerable to cross site scripting (CVE-2008-1502 ).

Moodle was prone to CSRF (CVE-2008-3325) / XSS (CVE-2008-3326) flaws which could potentially be exploited to compromise arbitrary accounts.

ID	Name	Product	Family	Severity
40067	openSUSE Security Update : moodle (moodle-127)	Nessus	SuSE Local Security Checks	low
35254	Debian DSA-1691-1 : moodle - several vulnerabilities	Nessus	Debian Local Security Checks	critical
33838	openSUSE 10 Security Update : moodle (moodle-5488)	Nessus	SuSE Local Security Checks	low
33837	openSUSE 10 Security Update : moodle (moodle-5487)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2008-3326

medium

Tenable Plugins

low

critical

low

medium