NVD Vulnerability Detail

CVE-2014-3544

Summary	Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field.
Publication Date	July 29, 2014, 8:10 p.m.
Registration Date	Jan. 26, 2021, 3:10 p.m.
Last Update	Nov. 21, 2024, 11:08 a.m.

Affected software configurations

Configuration4		or higher	or less	more than	less than
cpe:2.3:a:moodle:moodle:2.7.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45683	Patch
2	http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45683	Patch
3	http://openwall.com/lists/oss-security/2014/07/21/1
4	http://openwall.com/lists/oss-security/2014/07/21/1
5	http://osandamalith.wordpress.com/2014/07/25/moodle-2-7-persistent-xss/	Exploit
6	http://osandamalith.wordpress.com/2014/07/25/moodle-2-7-persistent-xss/	Exploit
7	http://osvdb.org/show/osvdb/109337
8	http://osvdb.org/show/osvdb/109337
9	http://packetstormsecurity.com/files/127624/Moodle-2.7-Cross-Site-Scripting.html	Exploit
10	http://packetstormsecurity.com/files/127624/Moodle-2.7-Cross-Site-Scripting.html	Exploit
11	http://www.exploit-db.com/exploits/34169
12	http://www.exploit-db.com/exploits/34169
13	http://www.securityfocus.com/bid/68756
14	http://www.securityfocus.com/bid/68756
15	https://github.com/moodle/moodle/commit/ce5a785b0962c3c94c7a7b0d36176482d21db95d	Patch
16	https://github.com/moodle/moodle/commit/ce5a785b0962c3c94c7a7b0d36176482d21db95d	Patch
17	https://moodle.org/mod/forum/discuss.php?d=264265	Vendor Advisory
18	https://moodle.org/mod/forum/discuss.php?d=264265	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-79	クロスサイト・スクリプティング（XSS）	https://cwe.mitre.org/data/definitions/79.html

JVN Vulnerability Information

Moodle の user/profile.php におけるクロスサイトスクリプティングの脆弱性

Title	Moodle の user/profile.php におけるクロスサイトスクリプティングの脆弱性
Summary	Moodle の user/profile.php には、クロスサイトスクリプティングの脆弱性が存在します。
Possible impacts	リモート認証されたユーザにより、Skype ID profile フィールドを介して、任意の Web スクリプトまたは HTML を挿入される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	July 21, 2014, midnight
Registration Date	July 30, 2014, 6:41 p.m.
Last Update	July 30, 2014, 6:41 p.m.

Affected System

Moodle

Moodle 2.3.11 まで

Moodle 2.4.11 未満の 2.4.x

Moodle 2.5.7 未満の 2.5.x

Moodle 2.6.4 未満の 2.6.x

Moodle 2.7.1 未満の 2.7.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-3544	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3544
National Vulnerability Database (NVD)
2	CVE-2014-3544	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3544

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-79	https://jvndb.jvn.jp/ja/cwe/CWE-79.html

ベンダー情報

No	Name	URL
GitHub
1	MDL-45683 user: Escaping Skype ID used in profile	https://github.com/moodle/moodle/commit/ce5a785b0962c3c94c7a7b0d36176482d21db95d
Moodle
2	MDL-45683	http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45683
Security Announcements
3	MSA-14-0024: Cross-site scripting vulnerability in profile field	https://moodle.org/mod/forum/discuss.php?d=264265

Change Log

No	Changed Details	Date of change
0	[2014年07月30日] 掲載	Feb. 17, 2018, 10:37 a.m.