Lucene search

[email protected]CVE-2009-0502

HistoryFeb 10, 2009 - 2:30 a.m.

CVE-2009-0502

2009-02-1002:30:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2009-0502

cross-site scripting

xss vulnerability

snoopy

moodle

html block

remote attackers

web script

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.5 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.9%

JSON

Cross-site scripting (XSS) vulnerability in blocks/html/block_html.php in Snoopy 1.2.3, as used in Moodle 1.6 before 1.6.9, 1.7 before 1.7.7, 1.8 before 1.8.8, and 1.9 before 1.9.4, allows remote attackers to inject arbitrary web script or HTML via an HTML block, which is not properly handled when the “Login as” feature is used to visit a MyMoodle or Blog page.

Affected configurations

NVD

Node

snoopysnoopyMatch1.2.3

AND

moodlemoodleMatch1.7.0

moodlemoodleMatch1.7.1

moodlemoodleMatch1.7.2

moodlemoodleMatch1.7.3

moodlemoodleMatch1.7.4

moodlemoodleMatch1.7.5

moodlemoodleMatch1.7.6

moodlemoodleMatch1.8.1

moodlemoodleMatch1.8.2

moodlemoodleMatch1.8.3

moodlemoodleMatch1.8.4

moodlemoodleMatch1.8.5

moodlemoodleMatch1.8.6

moodlemoodleMatch1.8.7

moodlemoodleMatch1.9.1

moodlemoodleMatch1.9.2

moodlemoodleMatch1.9.3

CPENameOperatorVersion
snoopy:snoopysnoopyeq1.2.3
moodle:moodlemoodleeq1.7.0
moodle:moodlemoodleeq1.7.1
moodle:moodlemoodleeq1.7.2
moodle:moodlemoodleeq1.7.3
moodle:moodlemoodleeq1.7.4
moodle:moodlemoodleeq1.7.5
moodle:moodlemoodleeq1.7.6
moodle:moodlemoodleeq1.8.1
moodle:moodlemoodleeq1.8.2

CPE	Name	Operator	Version
snoopy:snoopy	snoopy	eq	1.2.3
moodle:moodle	moodle	eq	1.7.0
moodle:moodle	moodle	eq	1.7.1
moodle:moodle	moodle	eq	1.7.2
moodle:moodle	moodle	eq	1.7.3
moodle:moodle	moodle	eq	1.7.4
moodle:moodle	moodle	eq	1.7.5
moodle:moodle	moodle	eq	1.7.6
moodle:moodle	moodle	eq	1.8.1
moodle:moodle	moodle	eq	1.8.2