Moodle vulnerable to XSS via bundled spikephpcoverage library

published 2012-07-16 14 y ago modified 2026-06-16 4 mo ago also GHSA-mx5g-3vxh-rgm8 , EUVD-2022-4646

cvss: 4.3; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 3.6%; EPSS 3.6% chance of exploitation in 30 days, percentile 89%
public exploits: 1; Exploit-DB

Cross-site scripting (XSS) vulnerability in the Spike PHPCoverage (aka spikephpcoverage) library, as used in Moodle 2.0.x before 2.0.2 and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Patch / fix

fixed in 1 links 2

packagist moodle/moodle 2.0.2

Timeline

2011-02-01 First public exploit (EDB-35297)
2012-07-16 Published

Exploit prediction

3.62% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

EDB-35297 Moodle 2.0.1 - 'PHPCOVERAGE_HOME' Cross-Site Scripting webapps, 2011-02-01

CVSS scores

assigned by	version	score	vector
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected packages

ecosystem	package	affected	fixed in
packagist	moodle/moodle	>=2.0, <2.0.2	2.0.2

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

github.com /moodle/moodle/commit/bd654f0ced8af925c27b7c94321f0c299b50b38e
web
git.moodle.org /gw?p=moodle.git;a=commit;h=bd654f0ced8af925c27b7c94321f0c299b50b38e
web
moodle.org /mod/forum/discuss.php?d=170005
web, vendor-advisory
openwall.com /lists/oss-security/2011/11/14/1
mailing-list, web
git.moodle.org /gw?p=moodle.git%3Ba=commit%3Bh=bd654f0ced8af925c27b7c94321f0c299b50b38e
nvd.nist.gov /vuln/detail/CVE-2011-4280
advisory
github.com /moodle/moodle
package

Sources

CVE List CVE-2011-4280
GitHub Advisory GHSA-mx5g-3vxh-rgm8
NVD CVE-2011-4280

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary