CVE-2015-3178

Severity: low (CVSS 3.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-06-01 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the external_format_text function in lib/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to inject arbitrary web script or HTML into an external application via a crafted string that is visible to web services.

Affected products

Moodle: through 2.5.9; 2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.5.4, 2.5.5 (+28)

References

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49718
http://openwall.com/lists/oss-security/2015/05/18/1
http://www.securityfocus.com/bid/74726
http://www.securitytracker.com/id/1032358
https://moodle.org/mod/forum/discuss.php?d=313685
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49718
http://openwall.com/lists/oss-security/2015/05/18/1
http://www.securityfocus.com/bid/74726
http://www.securitytracker.com/id/1032358
https://moodle.org/mod/forum/discuss.php?d=313685

Get alerted when CVE-2015-3178 or the next vulnerability affects your stack