Moderate severityNVD Advisory· Published Mar 25, 2008· Updated Apr 23, 2026
CVE-2008-1502
CVE-2008-1502
Description
The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cross-site scripting (XSS) attacks via a string containing crafted URL protocols.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
moodle/moodlePackagist | < 1.8.5 | 1.8.5 |
Affected products
43cpe:2.3:a:moodle:moodle:1.4.3:*:*:*:*:*:*:*+ 35 more
- cpe:2.3:a:moodle:moodle:1.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.5:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.5.0:beta:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*range: <=1.8.4
- cpe:2.3:a:moodle:moodle:1.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.6.3:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.6.4:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.6.5:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.6.6:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.6.7:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.7.3:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.7.4:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.7.5:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.7.6:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.8.2:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:1.8.3:*:*:*:*:*:*:*
cpe:2.3:a:egroupware:egroupware:*:*:*:*:*:*:*:*+ 6 more
- cpe:2.3:a:egroupware:egroupware:*:*:*:*:*:*:*:*range: <=1.4.002
- cpe:2.3:a:egroupware:egroupware:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:egroupware:egroupware:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:egroupware:egroupware:1.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:egroupware:egroupware:1.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:egroupware:egroupware:1.2.106-2:*:*:*:*:*:*:*
- cpe:2.3:a:egroupware:egroupware:1.4.001:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
33- docs.moodle.org/en/Release_NotesnvdPatchVendor AdvisoryWEB
- www.debian.org/security/2008/dsa-1691nvdPatchWEB
- www.securityfocus.com/bid/28424nvdPatch
- www.egroupware.org/viewvc/branches/1.4/phpgwapi/inc/class.kses.inc.phpnvdExploitWEB
- secunia.com/advisories/29491nvdVendor Advisory
- secunia.com/advisories/30073nvdVendor Advisory
- secunia.com/advisories/30986nvdVendor Advisory
- secunia.com/advisories/31017nvdVendor Advisory
- secunia.com/advisories/31018nvdVendor Advisory
- secunia.com/advisories/32400nvdVendor Advisory
- secunia.com/advisories/32446nvdVendor Advisory
- www.vupen.com/english/advisories/2008/0989/referencesnvdVendor Advisory
- github.com/advisories/GHSA-v759-3wr5-p294ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2008-1502ghsaADVISORY
- lists.opensuse.org/opensuse-security-announce/2008-07/msg00006.htmlnvdWEB
- www.debian.org/security/2009/dsa-1871nvdWEB
- www.egroupware.org/changelognvdWEB
- www.gentoo.org/security/en/glsa/glsa-200805-04.xmlnvdWEB
- www.openwall.com/lists/oss-security/2008/07/08/14nvdWEB
- exchange.xforce.ibmcloud.com/vulnerabilities/41435nvdWEB
- usn.ubuntu.com/658-1ghsaWEB
- web.archive.org/web/20080709031015/http://www.securityfocus.com/bid/28424ghsaWEB
- web.archive.org/web/20080828131802/http://secunia.com/advisories/31017ghsaWEB
- web.archive.org/web/20080905011948/http://secunia.com/advisories/31018ghsaWEB
- web.archive.org/web/20081011001554/http://secunia.com/advisories/31167ghsaWEB
- web.archive.org/web/20081025081058/http://secunia.com/advisories/32400ghsaWEB
- web.archive.org/web/20081028073531/http://secunia.com/advisories/32446ghsaWEB
- web.archive.org/web/20090129193143/http://secunia.com/advisories/30986ghsaWEB
- web.archive.org/web/20100819022833/http://secunia.com/advisories/30073ghsaWEB
- web.archive.org/web/20120719035305/http://secunia.com/advisories/29491ghsaWEB
- www.redhat.com/archives/fedora-package-announce/2008-July/msg00331.htmlnvdWEB
- secunia.com/advisories/31167nvd
- usn.ubuntu.com/658-1/nvd
News mentions
0No linked articles in our index yet.