{"id":"GHSA-2jcw-r79x-4r5v","aliases":["CVE-2015-0216"],"title":"Moodle does not set the RISK_XSS bit for graders","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"LOW","description":"access.php in the Lesson module in Moodle 2.8.x before 2.8.2 does not set the RISK_XSS bit for graders, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted essay feedback.","severity":"low","score":null,"published":"2022-05-13T01:12:49.000Z","modified":"2024-12-08T05:28:54.864Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"moodle/moodle","sources":[{"name":"OSV · GHSA-2jcw-r79x-4r5v","url":"https://osv.dev/vulnerability/GHSA-2jcw-r79x-4r5v"}],"ranges":[{"events":[{"introduced":"2.8.0"},{"fixed":"2.8.2"}],"type":"ECOSYSTEM"}],"versions":["v2.8.0","v2.8.1"],"fixed":["2.8.2"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2015-0216","https://github.com/moodle/moodle/commit/b9c86823c70a1cba20bca1c4b5b032ee1559e22d","https://github.com/moodle/moodle/commit/c80603ddc4ba4e7d85ea2b79f644a4a041cee137","https://github.com/moodle/moodle","https://moodle.org/mod/forum/discuss.php?d=278616","http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48034","http://openwall.com/lists/oss-security/2015/01/19/1"],"sources":[{"name":"OSV","id":"GHSA-2jcw-r79x-4r5v","modified":"2024-12-08T05:28:54.864340Z","url":"https://osv.dev/vulnerability/GHSA-2jcw-r79x-4r5v"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T22:05:31.879Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}