CVE-2014-3551

Description

Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) qualification or (2) rating field in a rubric.

References

https://moodle.org/mod/forum/discuss.php?d=264273

http://www.securityfocus.com/bid/68763

http://openwall.com/lists/oss-security/2014/07/21/1

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-46223

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3