Detections
Analytics
Moodle < 1.3.3 'help.php' 'file' Parameter XSS
medium Nessus Plugin ID 13843
Language:
Synopsis
The remote web server contains a PHP application that is affected by a cross-site scripting vulnerability.Description
The version of Moodle running on the remote host is affected by a cross-site scripting vulnerability. Input to the 'file' parameter of 'help.php' is not properly sanitized. A remote attacker can exploit this by tricking a user into requesting a maliciously crafted URL, resulting in stolen credentials.Solution
Upgrade to Moodle 1.3.3 or later.See Also
Plugin Details
Severity: Medium
ID: 13843
File Name: moodle_unknown_vuln.nasl
Version: 1.28
Type: remote
Family: CGI abuses : XSS
Published: 7/26/2004
Updated: 6/6/2024
Configuration: Enable thorough checks
Supported Sensors: Nessus
Enable CGI Scanning: true
Risk Information
VPR
Risk Factor: Medium
Score: 5.5
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:moodle:moodle
Required KB Items: www/PHP, installed_sw/Moodle
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No exploit is required
Patch Publication Date: 7/13/2004
Vulnerability Publication Date: 7/13/2004
Reference Information
CVE: CVE-2004-0725
BID: 10718