CVE-2014-9059

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-11-24 · updated 2026-06-17
Weakness: CWE-79

Description

lib/setup.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide charset information in HTTP headers, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via UTF-7 characters during interaction with AJAX scripts.

Affected products

Moodle: through 2.4.11; 2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.5.4, 2.5.5 (+12)

References

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47966
http://openwall.com/lists/oss-security/2014/11/17/11
http://www.securityfocus.com/bid/71133
http://www.securitytracker.com/id/1031215
https://moodle.org/mod/forum/discuss.php?d=275146
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47966
http://openwall.com/lists/oss-security/2014/11/17/11
http://www.securityfocus.com/bid/71133
http://www.securitytracker.com/id/1031215
https://moodle.org/mod/forum/discuss.php?d=275146

Get alerted when CVE-2014-9059 or the next vulnerability affects your stack