Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Moodle URL Downloader Allows Malicious Script Injection

CVE-2014-0218 · published 12 years ago
Summary

A security flaw in Moodle's URL Downloader feature allows attackers to inject malicious code into a website, potentially allowing them to steal sensitive information or take control of user sessions. This issue affects Moodle versions 2.3.11 and earlier, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3. To stay secure, update Moodle to the latest patched version.

What to do
  • Update moodle moodle to version 2.4.10.
  • Update moodle moodle to version 2.5.6.
  • Update moodle moodle to version 2.6.3.
Affected software
Ecosystem VendorProductAffected versions
composer moodle moodle < 2.4.10
>= 2.5.0, < 2.5.6
>= 2.6.0, < 2.6.3
Fix: upgrade to 2.4.10
– moodle moodle <= 2.3.11
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
52 more version ranges
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
Original advisory text
Cross-site scripting (XSS) vulnerability in the URL downloader repository in repository/url/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allows ...
Cross-site scripting (XSS) vulnerability in the URL downloader repository in repository/url/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
Severity
4.3 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published27 May 2014
Updated28 Oct 2026
First seen6 Mar 2026
Sources
GHSA-ch68-5r37-p7c3 · GHSA
CVE-2014-0218 · NVD
Track software like this
Free during beta