| Vulnerability Name: | CVE-2014-3550 (CCN-94728) | ||||||||||||
| Assigned: | 2014-07-21 | ||||||||||||
| Published: | 2014-07-21 | ||||||||||||
| Updated: | 2020-12-01 | ||||||||||||
| Summary: | Multiple cross-site scripting (XSS) vulnerabilities in admin/tool/task/scheduledtasks.php in Moodle 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via vectors that trigger a crafted (1) error or (2) success message for a scheduled task. | ||||||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
| ||||||||||||
| CVSS v2 Severity: | 4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N) 3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
| ||||||||||||
| Vulnerability Type: | CWE-79 | ||||||||||||
| Vulnerability Consequences: | Cross-Site Scripting | ||||||||||||
| References: | Source: MITRE Type: CNA CVE-2014-3550 Source: CONFIRM Type: Patch http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-46227 Source: MLIST Type: UNKNOWN [oss-security] 20140721 Moodle security notifications public Source: CCN Type: oss-security Mailing List, Mon, 21 Jul 2014 10:14:50 +0800 Moodle security notifications public Source: BID Type: UNKNOWN 68762 Source: CCN Type: BID-68762 Moodle CVE-2014-3550 Cross Site Scripting Vulnerability Source: XF Type: UNKNOWN moodle-cve20143550-xss(94728) Source: CCN Type: MSA-14-0031 Cross-site scripting though scheduled task error messages Source: CONFIRM Type: Vendor Advisory https://moodle.org/mod/forum/discuss.php?d=264272 Source: CCN Type: WhiteSource Vulnerability Database CVE-2014-3550 | ||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||
| Oval Definitions | |||||||||||||
| |||||||||||||
| BACK | |||||||||||||