{"id":"CVE-2014-3544","aliases":["EUVD-2022-3549","GHSA-c9jp-244j-vh78","MGASA-2014-0308"],"status":"published","title":"Moodle cross-site scripting (XSS) vulnerability","description":"Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field.","severity":{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04667,"percentile":0.91818,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-79"],"published":"2014-07-29T10:00:00Z","modified":"2026-06-17T00:08:27Z","exploits":[{"source":"exploitdb","id":"EDB-34169","title":"Moodle 2.7 - Persistent Cross-Site Scripting","type":"webapps","platform":"php","date":"2014-07-27","url":"https://www.exploit-db.com/exploits/34169"}],"fixes":[{"ecosystem":"Packagist","package":"moodle/moodle","fixed_in":["2.4.11","2.5.7","2.6.4","2.7.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.11"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.7"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.4"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.11"}]}],"versions":["v2.3.10","v2.3.11","v2.3.4","v2.3.5","v2.3.6","v2.3.7","v2.3.8","v2.3.9","v2.4.0","v2.4.0-rc1","v2.4.1","v2.4.10","v2.4.2","v2.4.3","v2.4.4","v2.4.5","v2.4.6","v2.4.7","v2.4.8","v2.4.9"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.7"}]}],"versions":["v2.5.0","v2.5.1","v2.5.2","v2.5.3","v2.5.4","v2.5.5","v2.5.6"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.4"}]}],"versions":["v2.6.0","v2.6.1","v2.6.2","v2.6.3"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.1"}]}],"versions":["v2.7.0"]},{"source":"osv","ecosystem":"Mageia:3","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-1.mga3"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:4","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-1.mga4"}]}],"bundled":10}],"products":[{"vendor":"moodle","product":"moodle"}],"references":[{"url":"http://openwall.com/lists/oss-security/2014/07/21/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://osandamalith.wordpress.com/2014/07/25/moodle-2-7-persistent-xss/","tags":["x_refsource_MISC","x_transferred","Exploit"]},{"url":"http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-45683","tags":["x_refsource_CONFIRM","x_transferred","Patch","web"]},{"url":"http://packetstormsecurity.com/files/127624/Moodle-2.7-Cross-Site-Scripting.html","tags":["x_refsource_MISC","x_transferred","Exploit","web"]},{"url":"http://www.exploit-db.com/exploits/34169","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","web"]},{"url":"http://osvdb.org/show/osvdb/109337","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/68756","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://github.com/moodle/moodle/commit/ce5a785b0962c3c94c7a7b0d36176482d21db95d","tags":["x_refsource_CONFIRM","x_transferred","Patch","web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=264265","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3544","tags":["advisory"]},{"url":"https://github.com/moodle/moodle/commit/0207466e778baebff21c7b72bc688761f9c5b0d9","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/739d227c58886e9a1be1426ed66053f1d37ee9a9","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/f7b6562f20f6af4119c7775477cffbaa83229f74","tags":["web"]},{"url":"https://github.com/advisories/GHSA-c9jp-244j-vh78"},{"url":"https://github.com/moodle/moodle","tags":["package"]},{"url":"http://osandamalith.wordpress.com/2014/07/25/moodle-2-7-persistent-xss","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2014-0308.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13759","tags":["report"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=264262","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=264263","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=264264","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=264266","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=264267","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=264268","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=264269","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=264270","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=264273","tags":["web"]},{"url":"http://docs.moodle.org/dev/Moodle_2.6.4_release_notes","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-3544","description":"Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field.","status":"published","published":"2014-07-29T10:00:00Z","modified":"2024-08-06T10:50:16.819Z","updated_at":"2026-11-02T14:33:44.569327Z"}],"euvd":[{"id":"EUVD-2022-3549","description":"Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field.","status":"published","published":"2014-07-29T10:00:00Z","modified":"2024-08-06T10:50:16Z","updated_at":"2026-11-03T01:57:10.446744Z"}],"ghsa":[{"id":"GHSA-c9jp-244j-vh78","title":"Moodle cross-site scripting (XSS) vulnerability","description":"Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field.","status":"published","published":"2022-05-13T01:12:40Z","modified":"2024-01-24T21:17:35Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:32.302254Z"}],"nvd":[{"id":"CVE-2014-3544","description":"Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field.","status":"published","published":"2014-07-29T11:10:32.137Z","modified":"2026-06-17T00:08:27.35Z","cvss":[{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:55.19899Z"}],"osv":[{"id":"GHSA-c9jp-244j-vh78","title":"Moodle cross-site scripting (XSS) vulnerability","description":"Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field.","status":"published","published":"2022-05-13T01:12:40Z","modified":"2024-12-07T05:38:27.946345Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:44.927642Z"},{"id":"MGASA-2014-0308","title":"Updated moodle package fixes security vulnerabilities","description":"In Moodle before 2.6.4, serialised data passed by repositories could\npotentially contain objects defined by add-ons that could include executable\ncode (CVE-2014-3541).\n\nIn Moodle before 2.6.4, it was possible for manipulated XML files passed from\nLTI servers to be interpreted by Moodle to allow access to server-side files\n(CVE-2014-3542).\n\nIn Moodle before 2.6.4, it was possible for manipulated XML files to be\nuploaded to the IMSCC course format or the IMSCP resource to allow access to\nserver-side files (CVE-2014-3543).\n\nIn Moodle before 2.6.4, filtering of the Skype profile field was not removing\npotentially harmful code (CVE-2014-3544).\n\nIn Moodle before 2.6.4, it was possible to inject code into Calculated\nquestions that would be executed on the server (CVE-2014-3545).\n\nIn Moodle before 2.6.4, it was possible to get limited user information,\nsuch as user name and courses, by manipulating the URL of profile and notes\npages (CVE-2014-3546).\n\nIn Moodle before 2.6.4, the details of badges from external sources were not\nbeing filtered (CVE-2014-3547).\n\nIn Moodle before 2.6.4, content of exception dialogues presented from AJAX\ncalls was not being escaped before being presented to users (CVE-2014-3548).\n\nIn Moodle before 2.6.4, fields in rubrics were not being correctly filtered\n(CVE-2014-3551).\n\nIn Moodle before 2.6.4, forum was allowing users who were members of more\nthan one group to post to all groups without the capability to access all\ngroups (CVE-2014-3553).\n\nThe moodle package has been updated to version 2.6.4, to fix these issues\nand other bugs.\n","status":"published","published":"2014-08-05T20:08:48Z","modified":"2026-04-16T06:24:39.334873342Z","updated_at":"2026-11-02T15:49:39.488462Z"}]}}