CVE-2015-3178

Published: Jun 1, 2015Modified: May 6, 2026

3.5

Vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability: 6.8 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in the external_format_text function in lib/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to inject arbitrary web script or HTML into an external application via a crafted string that is visible to web services.

Affected (35)

Products: Moodle: Moodle

Moodle

1 product

Moodle

Configuration A

35 vulnerable

Vulnerable Software	Affected Versions
Moodle Moodle	Up to 2.5.9
Moodle Moodle	Version 2.5.0
Moodle Moodle	Version 2.5.1
Moodle Moodle	Version 2.5.2
Moodle Moodle	Version 2.5.3
Moodle Moodle	Version 2.5.4
Moodle Moodle	Version 2.5.5
Moodle Moodle	Version 2.5.6
Moodle Moodle	Version 2.5.7
Moodle Moodle	Version 2.5.8
Moodle Moodle	Version 2.6.0
Moodle Moodle	Version 2.6.10
Moodle Moodle	Version 2.6.1
Moodle Moodle	Version 2.6.2
Moodle Moodle	Version 2.6.3
Moodle Moodle	Version 2.6.4
Moodle Moodle	Version 2.6.5
Moodle Moodle	Version 2.6.6
Moodle Moodle	Version 2.6.7
Moodle Moodle	Version 2.6.8
Moodle Moodle	Version 2.6.9
Moodle Moodle	Version 2.7.0
Moodle Moodle	Version 2.7.1
Moodle Moodle	Version 2.7.2
Moodle Moodle	Version 2.7.3
Moodle Moodle	Version 2.7.4
Moodle Moodle	Version 2.7.5
Moodle Moodle	Version 2.7.6
Moodle Moodle	Version 2.7.7
Moodle Moodle	Version 2.8.0
Moodle Moodle	Version 2.8.1
Moodle Moodle	Version 2.8.2
Moodle Moodle	Version 2.8.3
Moodle Moodle	Version 2.8.4
Moodle Moodle	Version 2.8.5