CVE-2008-1502

The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cross-site scripting (XSS) attacks via a string containing crafted URL protocols.

Link	Resource
http://www.egroupware.org/viewvc/branches/1.4/phpgwapi/inc/class.kses.inc.php?r1=23625&r2=25110&pathrev=25110	Exploit
http://www.egroupware.org/changelog
http://secunia.com/advisories/29491	Vendor Advisory
http://www.securityfocus.com/bid/28424	Patch
http://www.gentoo.org/security/en/glsa/glsa-200805-04.xml
http://secunia.com/advisories/30073	Vendor Advisory
http://docs.moodle.org/en/Release_Notes#Moodle_1.8.5	Patch Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00006.html
http://secunia.com/advisories/31018	Vendor Advisory
http://www.openwall.com/lists/oss-security/2008/07/08/14
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00331.html
http://secunia.com/advisories/32446	Vendor Advisory
http://secunia.com/advisories/30986	Vendor Advisory
http://secunia.com/advisories/31017	Vendor Advisory
http://www.debian.org/security/2008/dsa-1691	Patch
http://secunia.com/advisories/32400	Vendor Advisory
http://www.debian.org/security/2009/dsa-1871
http://www.vupen.com/english/advisories/2008/0989/references	Vendor Advisory
http://secunia.com/advisories/31167
https://exchange.xforce.ibmcloud.com/vulnerabilities/41435
https://usn.ubuntu.com/658-1/

Configuration 1

cpe:2.3:a:egroupware:egroupware:1.0:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.5.2:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.6.1:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.8.2:*:*:*:*:*:*:* cpe:2.3:a:egroupware:egroupware:*:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.2.1:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.4.2:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.6.5:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.3.3:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.4.3:*:*:*:*:*:*:* cpe:2.3:a:egroupware:egroupware:1.0.6:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.4.5:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.7.6:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.6.2:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.7.1:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* cpe:2.3:a:egroupware:egroupware:1.2.106-2:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.8.3:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.3.2:*:*:*:*:*:*:* cpe:2.3:a:egroupware:egroupware:1.0.3:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.6.4:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.1.1:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.3.1:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.6.7:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.4.4:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.7.3:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.7.2:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.5.3:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.6.3:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.6.6:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.5:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.4.1:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.7.5:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.5.1:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.3.4:*:*:*:*:*:*:* cpe:2.3:a:egroupware:egroupware:1.4.001:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.8.1:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.7.4:*:*:*:*:*:*:* cpe:2.3:a:egroupware:egroupware:1.0.1:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.2.0:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.3.0:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.6.0:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:1.5.0:beta:*:*:*:*:*:*

---

Published : 2008-03-25 07:44

Updated : 2020-12-01 02:52

---

NVD link : CVE-2008-1502

Mitre link : CVE-2008-1502

No products.

CWE-79