{"id":"CVE-2014-3551","aliases":["EUVD-2022-4522","GHSA-m8f5-9wg8-2c3h","MGASA-2014-0308"],"status":"published","title":"Moodle multiple cross-site scripting (XSS) vulnerabilities","description":"Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) qualification or (2) rating field in a rubric.","severity":{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01749,"percentile":0.78001,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-79"],"published":"2014-07-29T10:00:00Z","modified":"2026-06-17T00:08:28Z","exploits":[{"source":"pocgithub","id":"JavaGarcia/CVE-2014-3551","title":"JavaGarcia/CVE-2014-3551","date":"2021-01-27","url":"https://github.com/JavaGarcia/CVE-2014-3551"}],"fixes":[{"ecosystem":"Packagist","package":"moodle/moodle","fixed_in":["2.4.11","2.5.7","2.6.4","2.7.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.11"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.7"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.4"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.11"}]}],"versions":["v2.3.10","v2.3.11","v2.3.4","v2.3.5","v2.3.6","v2.3.7","v2.3.8","v2.3.9","v2.4.0","v2.4.0-rc1","v2.4.1","v2.4.10","v2.4.2","v2.4.3","v2.4.4","v2.4.5","v2.4.6","v2.4.7","v2.4.8","v2.4.9"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.7"}]}],"versions":["v2.5.0","v2.5.1","v2.5.2","v2.5.3","v2.5.4","v2.5.5","v2.5.6"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.4"}]}],"versions":["v2.6.0","v2.6.1","v2.6.2","v2.6.3"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.1"}]}],"versions":["v2.7.0"]},{"source":"osv","ecosystem":"Mageia:3","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-1.mga3"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:4","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-1.mga4"}]}],"bundled":10}],"products":[{"vendor":"moodle","product":"moodle"}],"references":[{"url":"http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-46223","tags":["x_refsource_CONFIRM","x_transferred","Patch","web"]},{"url":"http://openwall.com/lists/oss-security/2014/07/21/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=264273","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://www.securityfocus.com/bid/68763","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3551","tags":["advisory"]},{"url":"https://github.com/moodle/moodle/commit/1f8eb0842835bcd1ea72b2d2982e0b5c8bc133bb","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/2c0b608cda12540de79aac0ee6952dda2c8ed947","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/470a466d7f1e0aef030ad2178bbef5a81765c42e","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/4fc5861cbacdc2f4197faebd3d207d2811e0f09f","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/555ee08b17dfe09e02391be137f60fe38c0a7865","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/666248c264642e5ca27601b347fc6913517e2853","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/68299e6154ae41b7e586904fd1b860cad7f65654","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/72d1a3ab0b002a9a5f32f3c2b61ffc9fa7f7b789","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/7f4db6f4d9014370df0265ab846ad76235af0cae","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/8380722bb11f36d33308580aee169e161d3f2c14","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/8ecc049f7f020086c1881bdf573af16cf2d9f9c9","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/98d5566c2270e21cbfaf1f4e8d61039f05d6aae2","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/b5dacb548800ee10d4940c8ebeca48c3c2ae0512","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/db5a6e6560c963849f8807184ca32efee6779264","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/e42b6e20bdd5d6f09bc09be22fd7f20736e27085","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/eb1381de1dbcce0215dcdd62cfac4fe287beed4e","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/f25f472be425d6ef8aa587648dafda1bd4d1c5d8","tags":["web"]},{"url":"https://web.archive.org/web/20200228170658/http://www.securityfocus.com/bid/68763","tags":["web"]},{"url":"https://github.com/advisories/GHSA-m8f5-9wg8-2c3h"},{"url":"https://github.com/moodle/moodle","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2014-0308.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13759","tags":["report"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=264262","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=264263","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=264264","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=264265","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=264266","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=264267","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=264268","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=264269","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=264270","tags":["web"]},{"url":"http://docs.moodle.org/dev/Moodle_2.6.4_release_notes","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-3551","description":"Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) qualification or (2) rating field in a rubric.","status":"published","published":"2014-07-29T10:00:00Z","modified":"2024-08-06T10:50:16.348Z","updated_at":"2026-11-02T14:33:44.23164Z"}],"euvd":[{"id":"EUVD-2022-4522","description":"Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) qualification or (2) rating field in a rubric.","status":"published","published":"2014-07-29T10:00:00Z","modified":"2024-08-06T10:50:16Z","updated_at":"2026-11-03T01:57:10.446744Z"}],"ghsa":[{"id":"GHSA-m8f5-9wg8-2c3h","title":"Moodle multiple cross-site scripting (XSS) vulnerabilities","description":"Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) qualification or (2) rating field in a rubric.","status":"published","published":"2022-05-13T01:12:41Z","modified":"2024-01-24T21:23:38Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:32.302254Z"}],"nvd":[{"id":"CVE-2014-3551","description":"Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) qualification or (2) rating field in a rubric.","status":"published","published":"2014-07-29T11:10:32.463Z","modified":"2026-06-17T00:08:28.11Z","cvss":[{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:55.19899Z"}],"osv":[{"id":"GHSA-m8f5-9wg8-2c3h","title":"Moodle multiple cross-site scripting (XSS) vulnerabilities","description":"Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) qualification or (2) rating field in a rubric.","status":"published","published":"2022-05-13T01:12:41Z","modified":"2024-12-07T05:50:17.537632Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:51.463834Z"},{"id":"MGASA-2014-0308","title":"Updated moodle package fixes security vulnerabilities","description":"In Moodle before 2.6.4, serialised data passed by repositories could\npotentially contain objects defined by add-ons that could include executable\ncode (CVE-2014-3541).\n\nIn Moodle before 2.6.4, it was possible for manipulated XML files passed from\nLTI servers to be interpreted by Moodle to allow access to server-side files\n(CVE-2014-3542).\n\nIn Moodle before 2.6.4, it was possible for manipulated XML files to be\nuploaded to the IMSCC course format or the IMSCP resource to allow access to\nserver-side files (CVE-2014-3543).\n\nIn Moodle before 2.6.4, filtering of the Skype profile field was not removing\npotentially harmful code (CVE-2014-3544).\n\nIn Moodle before 2.6.4, it was possible to inject code into Calculated\nquestions that would be executed on the server (CVE-2014-3545).\n\nIn Moodle before 2.6.4, it was possible to get limited user information,\nsuch as user name and courses, by manipulating the URL of profile and notes\npages (CVE-2014-3546).\n\nIn Moodle before 2.6.4, the details of badges from external sources were not\nbeing filtered (CVE-2014-3547).\n\nIn Moodle before 2.6.4, content of exception dialogues presented from AJAX\ncalls was not being escaped before being presented to users (CVE-2014-3548).\n\nIn Moodle before 2.6.4, fields in rubrics were not being correctly filtered\n(CVE-2014-3551).\n\nIn Moodle before 2.6.4, forum was allowing users who were members of more\nthan one group to post to all groups without the capability to access all\ngroups (CVE-2014-3553).\n\nThe moodle package has been updated to version 2.6.4, to fix these issues\nand other bugs.\n","status":"published","published":"2014-08-05T20:08:48Z","modified":"2026-04-16T06:24:39.334873342Z","updated_at":"2026-11-02T15:49:39.488462Z"}]}}