CVE-2014-7830

Description

Cross-site scripting (XSS) vulnerability in mod/feedback/mapcourse.php in the Feedback module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the mod/feedback:mapcourse capability to provide a searchcourse parameter.

References

https://moodle.org/mod/forum/discuss.php?d=275147

http://www.securitytracker.com/id/1031215

http://www.securityfocus.com/bid/71119

http://openwall.com/lists/oss-security/2014/11/17/11

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47865

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3