Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2015-3274

Good to know:

icon

Date: February 21, 2016

Cross-site scripting (XSS) vulnerability in the user_get_user_details function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to inject arbitrary web script or HTML by leveraging absence of an external_format_text call in a web service.

Language: PHP

Severity Score

Related Resources (12)

https://github.com/moodle/moodle/commit/e96e66aa16dca5cbcdb1aef0f9499edf86f1404b
https://nvd.nist.gov/vuln/detail/CVE-2015-3274
https://github.com/moodle/moodle/commit/ffe5c784889b3f7b2ba11cf9db881d54904623b7
http://openwall.com/lists/oss-security/2015/07/13/2
https://github.com/moodle/moodle/commit/7b15a363201109354bbd6d51a7c70f50dac7b9d8
https://web.archive.org/web/20150924032214/http://www.securitytracker.com/id/1032877
https://github.com/moodle/moodle
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50130
http://www.securitytracker.com/id/1032877
https://moodle.org/mod/forum/discuss.php?d=316664
https://github.com/moodle/moodle/commit/a809a8dccea222a31e0828d4f17889035e6d1a36
https://www.mend.io/vulnerability-database/CVE-2015-3274

Severity Score

Weakness Type (CWE)

Cross-Site Scripting (XSS)

CWE-79

Top Fix

icon

Upgrade Version

Upgrade to version 2.7.9,2.8.7,2.9.1

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): LOW
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): MEDIUM
Authentication (AU): NONE
Confidentiality (C): NONE
Integrity (I): PARTIAL
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us