{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2009-02-04T00:00:00", "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in blocks/html/block_html.php in Snoopy 1.2.3, as used in Moodle 1.6 before 1.6.9, 1.7 before 1.7.7, 1.8 before 1.8.8, and 1.9 before 1.9.4, allows remote attackers to inject arbitrary web script or HTML via an HTML block, which is not properly handled when the \"Login as\" feature is used to visit a MyMoodle or Blog page."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2009-04-01T09:00:00", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "SUSE-SR:2009:007", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://moodle.org/security/"}, {"name": "34418", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/34418"}, {"name": "33955", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/33955"}, {"name": "DSA-1724", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2009/dsa-1724"}, {"name": "[oss-security] 20090204 CVS request - Moodle", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2009/02/04/1"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2009-0502", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cross-site scripting (XSS) vulnerability in blocks/html/block_html.php in Snoopy 1.2.3, as used in Moodle 1.6 before 1.6.9, 1.7 before 1.7.7, 1.8 before 1.8.8, and 1.9 before 1.9.4, allows remote attackers to inject arbitrary web script or HTML via an HTML block, which is not properly handled when the \"Login as\" feature is used to visit a MyMoodle or Blog page."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "SUSE-SR:2009:007", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html"}, {"name": "http://moodle.org/security/", "refsource": "CONFIRM", "url": "http://moodle.org/security/"}, {"name": "34418", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/34418"}, {"name": "33955", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/33955"}, {"name": "DSA-1724", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2009/dsa-1724"}, {"name": "[oss-security] 20090204 CVS request - Moodle", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2009/02/04/1"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T04:40:03.511Z"}, "title": "CVE Program Container", "references": [{"name": "SUSE-SR:2009:007", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://moodle.org/security/"}, {"name": "34418", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/34418"}, {"name": "33955", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/33955"}, {"name": "DSA-1724", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2009/dsa-1724"}, {"name": "[oss-security] 20090204 CVS request - Moodle", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2009/02/04/1"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2009-0502", "datePublished": "2009-02-10T02:00:00", "dateReserved": "2009-02-09T00:00:00", "dateUpdated": "2024-08-07T04:40:03.511Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:snoopy:snoopy:1.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "4635C311-F808-474C-BD91-36F1C1C7D3E3", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:moodle:moodle:1.7.0:*:*:*:*:*:*:*", "matchCriteriaId": "CDC97F31-15F5-48D9-8768-D3FE5C0BD6E6", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.7.1:*:*:*:*:*:*:*", "matchCriteriaId": "FB16198E-A32D-4CFA-9CCE-65871596E6AC", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.7.2:*:*:*:*:*:*:*", "matchCriteriaId": "ABFE9D24-24DB-49EA-B59E-AF9B47D46EB4", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.7.3:*:*:*:*:*:*:*", "matchCriteriaId": "56551145-5213-4165-88C9-C351DACDD1C6", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.7.4:*:*:*:*:*:*:*", "matchCriteriaId": "A589727E-92BB-40DA-8172-89279EB9B73C", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.7.5:*:*:*:*:*:*:*", "matchCriteriaId": "92E97539-A7CC-48D3-A897-ADE4BC194B2E", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.7.6:*:*:*:*:*:*:*", "matchCriteriaId": "D19C1954-6330-449D-9101-378D5DBD122C", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.8.1:*:*:*:*:*:*:*", "matchCriteriaId": "492A28FE-A2F8-4FF7-AC5B-0C3F5508506D", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.8.2:*:*:*:*:*:*:*", "matchCriteriaId": "28A897CA-3D8F-4575-BBD2-1C0C5A2ECC99", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.8.3:*:*:*:*:*:*:*", "matchCriteriaId": "A4A3A5D9-D96E-46B3-AC22-25045564EB96", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.8.4:*:*:*:*:*:*:*", "matchCriteriaId": "AF91F8EA-1737-4E11-9931-ACAFB4BC0018", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.8.5:*:*:*:*:*:*:*", "matchCriteriaId": "1E81E148-5710-439C-8A1A-884D27640AAD", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.8.6:*:*:*:*:*:*:*", "matchCriteriaId": "A3B70465-F734-4C65-9790-0D83D03B7A16", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.8.7:*:*:*:*:*:*:*", "matchCriteriaId": "DE2C0217-A25A-4D0A-8CC6-64DEBC9E198F", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.1:*:*:*:*:*:*:*", "matchCriteriaId": "24F2602B-8ED3-4026-A9A4-31BE8BDC7724", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.2:*:*:*:*:*:*:*", "matchCriteriaId": "D7F24649-B67F-4809-9F54-7B623AEF5A4A", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.3:*:*:*:*:*:*:*", "matchCriteriaId": "6B81655E-C3B5-4115-A4C4-B7AC2FCDAB7F", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in blocks/html/block_html.php in Snoopy 1.2.3, as used in Moodle 1.6 before 1.6.9, 1.7 before 1.7.7, 1.8 before 1.8.8, and 1.9 before 1.9.4, allows remote attackers to inject arbitrary web script or HTML via an HTML block, which is not properly handled when the \"Login as\" feature is used to visit a MyMoodle or Blog page."}, {"lang": "es", "value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en blocks/html/block_html.php en Snoopy v1.2.3, como la utilizada en el Moodle v1.6 anterior a v1.6.9, v1.7 anterior a v1.7.7, v1.8 anterior a v1.8.8, y v1.9 anterior a v1.9.4, permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de un bloqueo HTML que no es manejado correctamente cuando la caracter\u00edstica \"Login as\" es utilizada para visitar una p\u00e1gina MyMoodle o Blog."}], "id": "CVE-2009-0502", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2009-02-10T02:30:00.563", "references": [{"source": "cve@mitre.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://moodle.org/security/"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/33955"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/34418"}, {"source": "cve@mitre.org", "url": "http://www.debian.org/security/2009/dsa-1724"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2009/02/04/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://moodle.org/security/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/33955"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/34418"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2009/dsa-1724"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2009/02/04/1"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "moodle: XSS vuln in HTML blocks", "id": "484924", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=484924"}, "csaw": false, "cwe": "CWE-79", "details": ["Cross-site scripting (XSS) vulnerability in blocks/html/block_html.php in Snoopy 1.2.3, as used in Moodle 1.6 before 1.6.9, 1.7 before 1.7.7, 1.8 before 1.8.8, and 1.9 before 1.9.4, allows remote attackers to inject arbitrary web script or HTML via an HTML block, which is not properly handled when the \"Login as\" feature is used to visit a MyMoodle or Blog page."], "name": "CVE-2009-0502", "public_date": "2009-02-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2009-0502\nhttps://nvd.nist.gov/vuln/detail/CVE-2009-0502"], "threat_severity": "Moderate"}