CVE-2012-3396 | BDVDB-2026-51164 Detail

Description#

Cross-site scripting (XSS) vulnerability in cohort/edit_form.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, 2.2.x before 2.2.4, and 2.3.x before 2.3.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the idnumber field. NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-2365.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://secunia.com/advisories/49890
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-34045
http://openwall.com/lists/oss-security/2012/07/17/1
http://www.securityfocus.com/bid/54481
https://exchange.xforce.ibmcloud.com/vulnerabilities/76962

Exploit#

No public exploit known

History#

Version 12012-07-23Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.