Description
Cross-site scripting (XSS) vulnerability in the MNET access-control interface in Moodle before 1.8.13 and 1.9.x before 1.9.9 allows remote attackers to inject arbitrary web script or HTML via vectors involving extended characters in a username.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | moodle | 1.8.13-1 | DSA-2115-1 |
Advisories 1
- DSA-2115-1 moodle - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://docs.moodle.org/en/Moodle_1.8.13_release_notes
- FEDORA-2010-10286 vendor-advisory
- ADV-2010-1571 vdb-entry
- [oss-security] 20100621 Re: CVE request: moodle 1.9.9/1.8.13 multiple vulnerabilities mailing-list
- 40352 third-party-advisory
- ADV-2010-1530 vdb-entry
- FEDORA-2010-10321 vendor-advisory
- http://docs.moodle.org/en/Moodle_1.9.9_release_notes
- 40248 third-party-advisory
- FEDORA-2010-10291 vendor-advisory
- http://moodle.org/mod/forum/discuss.php?d=152366
- http://tracker.moodle.org/browse/MDL-22040
- SUSE-SR:2010:014 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=605809