Description

A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. When a quiz question bank is imported, it was possible for the question preview that is displayed to execute JavaScript that is written into the question bank.

Remediation

References

CVE-2018-10891

Related Vulnerabilities

WordPress Plugin Ads Pro-Multi-Purpose WordPress Advertising Manager Multiple Vulnerabilities (3.4)

Apache Traffic Server Memory Disclosure Vulnerability (CVE-2020-17508)

PrestaShop Observable Timing Discrepancy Vulnerability (CVE-2026-25597)

Dot CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-3938)

Moodle Exposure of Resource to Wrong Sphere Vulnerability (CVE-2023-1402)

Severity

High

Classification

CVE-2018-10891 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Tags

Missing Update Known Vulnerabilities