CVE-2015-3174

Published: Jun 1, 2015Modified: May 6, 2026

3.5

Vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability: 6.8 / Impact: 2.9

Source: NVD

Description

mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISK_XSS bit for graders, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted gradebook feedback during manual quiz grading.

Affected (35)

Products: Moodle: Moodle

Moodle

1 product

Moodle

Configuration A

35 vulnerable

Vulnerable Software	Affected Versions
Moodle Moodle	Up to 2.5.9
Moodle Moodle	Version 2.5.0
Moodle Moodle	Version 2.5.1
Moodle Moodle	Version 2.5.2
Moodle Moodle	Version 2.5.3
Moodle Moodle	Version 2.5.4
Moodle Moodle	Version 2.5.5
Moodle Moodle	Version 2.5.6
Moodle Moodle	Version 2.5.7
Moodle Moodle	Version 2.5.8
Moodle Moodle	Version 2.6.0
Moodle Moodle	Version 2.6.10
Moodle Moodle	Version 2.6.1
Moodle Moodle	Version 2.6.2
Moodle Moodle	Version 2.6.3
Moodle Moodle	Version 2.6.4
Moodle Moodle	Version 2.6.5
Moodle Moodle	Version 2.6.6
Moodle Moodle	Version 2.6.7
Moodle Moodle	Version 2.6.8
Moodle Moodle	Version 2.6.9
Moodle Moodle	Version 2.7.0
Moodle Moodle	Version 2.7.1
Moodle Moodle	Version 2.7.2
Moodle Moodle	Version 2.7.3
Moodle Moodle	Version 2.7.4
Moodle Moodle	Version 2.7.5
Moodle Moodle	Version 2.7.6
Moodle Moodle	Version 2.7.7
Moodle Moodle	Version 2.8.0
Moodle Moodle	Version 2.8.1
Moodle Moodle	Version 2.8.2
Moodle Moodle	Version 2.8.3
Moodle Moodle	Version 2.8.4
Moodle Moodle	Version 2.8.5