Description
The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wordpress | 3.0.4+dfsg-1 | — |
| Debian 13 | wordpress | 3.0.4+dfsg-1 | — |
| Debian 12 | wordpress | 3.0.4+dfsg-1 | — |
| Debian 5.0 | moodle | 1.8.13-1 | DSA-2115-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | moodle/moodle | < 1.8.13 | 1.8.13 | GHSA-3gm8-32vv-q8mp |
| Packagist | moodle/moodle | >= 1.9.0, < 1.9.9 | 1.9.9 | GHSA-3gm8-32vv-q8mp |
Advisories 1
- DSA-2115-1 moodle - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://tracker.moodle.org/browse/MDL-22042
- http://cvs.moodle.org/moodle/lib/weblib.php?r1=1.970.2.171&r2=1.970.2.172
- http://docs.moodle.org/en/Moodle_1.8.13_release_notes
- FEDORA-2010-10286 vendor-advisory
- ADV-2010-1571 vdb-entry
- [oss-security] 20100621 Re: CVE request: moodle 1.9.9/1.8.13 multiple vulnerabilities mailing-list
- 40352 third-party-advisory
- ADV-2010-1530 vdb-entry
- http://moodle.org/mod/forum/discuss.php?d=152368
- FEDORA-2010-10321 vendor-advisory
- http://docs.moodle.org/en/Moodle_1.9.9_release_notes
- 40248 third-party-advisory
- FEDORA-2010-10291 vendor-advisory
- http://cvs.moodle.org/moodle/lib/weblib.php?r1=1.812.2.114&r2=1.812.2.115
- SUSE-SR:2010:014 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=605809