| Package | Affected versions | Patched versions |
|---|---|---|
| moodle/moodle | ≥ 2.7.0, < 2.7.11≥ 2.8.0, < 2.8.9≥ 2.9.0, < 2.9.3≤ 2.6.11 | 2.7.112.8.92.9.3 |
| moodle | = 2.7.0= 2.7.1= 2.7.10= 2.7.2= 2.7.3= 2.7.4= 2.7.5= 2.7.6= 2.7.7= 2.7.8= 2.7.9= 2.8.0= 2.8.1= 2.8.2= 2.8.3= 2.8.4= 2.8.5= 2.8.6= 2.8.7= 2.8.8= 2.9.0= 2.9.1= 2.9.2≤ 2.6.11 |
Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly restrict the availability of Flowplayer, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted .swf file.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free