CVE-2014-3544

Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field.

CVSS v2.0 NVD

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

4.67% chance of exploitation in the next 30 days, 92nd percentile

Published

2014-07-29

Updated

2024-08-06

Proof-of-concept exploits (1)

• http://www.exploit-db.com/exploits/34169

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/34169

Security advisories

• https://moodle.org/mod/forum/discuss.php?d=264265
• advisories/GHSA-c9jp-244j-vh78
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45683
• moodle/moodle/commit/ce5a785b0962c3c94c7a7b0d36176482d21db95d
• http://www.securityfocus.com/bid/68756

References

• CVE Record
• NVD entry