CVE-2017-2645

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

In Moodle 3.x, XSS can occur via attachments to evidence of prior learning.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Mar 26, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-26467.5It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParCVE-2017-26477.8The KEYS subsystem in the Linux kernel before 3.18 allows local users to gain privileges or cause a denial of service (NULL pointer derefereCVE-2017-26485.6It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification, thereby enabling Man-in-the-Middle atCVE-2017-26498.1It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active DirectorCVE-2017-26508.5It was found that the use of Pipeline: Classpath Step Jenkins plugin enables a bypass of the Script Security sandbox for users with SCM commCVE-2017-26513.7jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamicallyCVE-2017-26528.8It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jenkins that proviCVE-2017-26536.5A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST requesCVE-2017-26545.3jenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure. The Email Extension Plugins is able to send emails to a dyCVE-2017-26586.5It was discovered that the Dashbuilder login page as used in Red Hat JBoss BPM Suite before 6.4.2 and Red Hat JBoss Data Virtualization & SeCVE-2017-26597.5It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an invalid username is CVE-2017-26616.1ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field w
CVE-2017-2645: Medium severity, CVSS 6.1 | Vulnix