Bug 484924 (CVE-2009-0502)

Summary:	CVE-2009-0502 moodle: XSS vuln in HTML blocks
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	gwync
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0502
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2009-02-19 08:11:38 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	484917, 484918, 484919, 484920, 484921
Bug Blocks:

Description Vincent Danen 2009-02-10 18:13:57 UTC

me: CVE-2009-0502
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0502
Assigned: 20090209
Reference: MLIST:[oss-security] 20090204 CVS request - Moodle
Reference: URL: http://www.openwall.com/lists/oss-security/2009/02/04/1
Reference: CONFIRM: http://moodle.org/security/

Cross-site scripting (XSS) vulnerability in blocks/html/block_html.php
in Snoopy 1.2.3, as used in Moodle 1.6 before 1.6.9, 1.7 before 1.7.7,
1.8 before 1.8.8, and 1.9 before 1.9.4, allows remote attackers to
inject arbitrary web script or HTML via an HTML block, which is not
properly handled when the "Login as" feature is used to visit a
MyMoodle or Blog page.

Additional information from upstream (http://moodle.org/security/)

MSA-09-0004 - XSS vulnerabilities in HTML blocks if "Login as" used 
Versions affected:       < 1.9.4, < 1.8.8, < 1.7.7, < 1.6.9 
http://cvs.moodle.org/moodle/blocks/html/config_instance.html?r1=1.6&r2=1.6.10.1
http://cvs.moodle.org/moodle/blocks/html/block_html.php?r1=1.8.22.6&r2=1.8.22.7

Comment 1 Red Hat Product Security 2009-02-19 08:11:38 UTC

This issue was addressed in:

Fedora:
  https://admin.fedoraproject.org/updates/F10/FEDORA-2009-1699
  https://admin.fedoraproject.org/updates/F9/FEDORA-2009-1641