Read the docs
TI-2008-01439 Aliases CVE-2008-1502GHSA-v759-3wr5-p294

The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in…

Priority LOW 33CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cross-site scripting (XSS) attacks via a string containing crafted URL protocols.

Why it matters now

EPSS 0.10503 95th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed moodle/moodle (Packagist): 1.8.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—moodle/moodle (Packagist)before 1.8.51.8.5Patch availableGHSA-v759-3wr5-p294
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • moodle/moodle (Packagist) Vendor— Affected before 1.8.5 Fixed in 1.8.5 Patch available GHSA-v759-3wr5-p294

CPE configurations NVD · 43

CPEVersionsRoleVendor
cpe:2.3:a:egroupware:egroupware:*:*:*:*:*:*:*:*up to 1.4.002VulnerableEGroupware
cpe:2.3:a:egroupware:egroupware:1.0:*:*:*:*:*:*:*1.0VulnerableEGroupware
cpe:2.3:a:egroupware:egroupware:1.0.1:*:*:*:*:*:*:*1.0.1VulnerableEGroupware
cpe:2.3:a:egroupware:egroupware:1.0.3:*:*:*:*:*:*:*1.0.3VulnerableEGroupware
cpe:2.3:a:egroupware:egroupware:1.0.6:*:*:*:*:*:*:*1.0.6VulnerableEGroupware
cpe:2.3:a:egroupware:egroupware:1.2.106-2:*:*:*:*:*:*:*1.2.106-2VulnerableEGroupware
cpe:2.3:a:egroupware:egroupware:1.4.001:*:*:*:*:*:*:*1.4.001VulnerableEGroupware
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*up to 1.8.4VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.1.1:*:*:*:*:*:*:*1.1.1VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.2.0:*:*:*:*:*:*:*1.2.0VulnerableMoodle
  • cpe:2.3:a:egroupware:egroupware:*:*:*:*:*:*:*:* Versions up to 1.4.002 Vulnerable ·EGroupware
  • cpe:2.3:a:egroupware:egroupware:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·EGroupware
  • cpe:2.3:a:egroupware:egroupware:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·EGroupware
  • cpe:2.3:a:egroupware:egroupware:1.0.3:*:*:*:*:*:*:* Versions 1.0.3 Vulnerable ·EGroupware
  • cpe:2.3:a:egroupware:egroupware:1.0.6:*:*:*:*:*:*:* Versions 1.0.6 Vulnerable ·EGroupware
  • cpe:2.3:a:egroupware:egroupware:1.2.106-2:*:*:*:*:*:*:* Versions 1.2.106-2 Vulnerable ·EGroupware
  • cpe:2.3:a:egroupware:egroupware:1.4.001:*:*:*:*:*:*:* Versions 1.4.001 Vulnerable ·EGroupware
  • cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* Versions up to 1.8.4 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·Moodle
Show 33 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:moodle:moodle:1.2.1:*:*:*:*:*:*:*1.2.1VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.3.0:*:*:*:*:*:*:*1.3.0VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.3.1:*:*:*:*:*:*:*1.3.1VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.3.2:*:*:*:*:*:*:*1.3.2VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.3.3:*:*:*:*:*:*:*1.3.3VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.3.4:*:*:*:*:*:*:*1.3.4VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.4.1:*:*:*:*:*:*:*1.4.1VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.4.2:*:*:*:*:*:*:*1.4.2VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.4.3:*:*:*:*:*:*:*1.4.3VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.4.4:*:*:*:*:*:*:*1.4.4VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.4.5:*:*:*:*:*:*:*1.4.5VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.5:*:*:*:*:*:*:*1.5VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.5.0:beta:*:*:*:*:*:*1.5.0 betaVulnerableMoodle
cpe:2.3:a:moodle:moodle:1.5.1:*:*:*:*:*:*:*1.5.1VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.5.2:*:*:*:*:*:*:*1.5.2VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.5.3:*:*:*:*:*:*:*1.5.3VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.6.0:*:*:*:*:*:*:*1.6.0VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.6.1:*:*:*:*:*:*:*1.6.1VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.6.2:*:*:*:*:*:*:*1.6.2VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.6.3:*:*:*:*:*:*:*1.6.3VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.6.4:*:*:*:*:*:*:*1.6.4VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.6.5:*:*:*:*:*:*:*1.6.5VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.6.6:*:*:*:*:*:*:*1.6.6VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.6.7:*:*:*:*:*:*:*1.6.7VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.7.1:*:*:*:*:*:*:*1.7.1VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.7.2:*:*:*:*:*:*:*1.7.2VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.7.3:*:*:*:*:*:*:*1.7.3VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.7.4:*:*:*:*:*:*:*1.7.4VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.7.5:*:*:*:*:*:*:*1.7.5VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.7.6:*:*:*:*:*:*:*1.7.6VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.8.1:*:*:*:*:*:*:*1.8.1VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.8.2:*:*:*:*:*:*:*1.8.2VulnerableMoodle
cpe:2.3:a:moodle:moodle:1.8.3:*:*:*:*:*:*:*1.8.3VulnerableMoodle
  • cpe:2.3:a:moodle:moodle:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.3.1:*:*:*:*:*:*:* Versions 1.3.1 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.3.2:*:*:*:*:*:*:* Versions 1.3.2 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.3.3:*:*:*:*:*:*:* Versions 1.3.3 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.3.4:*:*:*:*:*:*:* Versions 1.3.4 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.4.1:*:*:*:*:*:*:* Versions 1.4.1 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.4.2:*:*:*:*:*:*:* Versions 1.4.2 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.4.3:*:*:*:*:*:*:* Versions 1.4.3 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.4.4:*:*:*:*:*:*:* Versions 1.4.4 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.4.5:*:*:*:*:*:*:* Versions 1.4.5 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.5:*:*:*:*:*:*:* Versions 1.5 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.5.0:beta:*:*:*:*:*:* Versions 1.5.0 beta Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.5.1:*:*:*:*:*:*:* Versions 1.5.1 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.5.2:*:*:*:*:*:*:* Versions 1.5.2 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.5.3:*:*:*:*:*:*:* Versions 1.5.3 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.6.0:*:*:*:*:*:*:* Versions 1.6.0 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.6.1:*:*:*:*:*:*:* Versions 1.6.1 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.6.2:*:*:*:*:*:*:* Versions 1.6.2 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.6.3:*:*:*:*:*:*:* Versions 1.6.3 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.6.4:*:*:*:*:*:*:* Versions 1.6.4 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.6.5:*:*:*:*:*:*:* Versions 1.6.5 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.6.6:*:*:*:*:*:*:* Versions 1.6.6 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.6.7:*:*:*:*:*:*:* Versions 1.6.7 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.7.1:*:*:*:*:*:*:* Versions 1.7.1 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.7.2:*:*:*:*:*:*:* Versions 1.7.2 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.7.3:*:*:*:*:*:*:* Versions 1.7.3 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.7.4:*:*:*:*:*:*:* Versions 1.7.4 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.7.5:*:*:*:*:*:*:* Versions 1.7.5 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.7.6:*:*:*:*:*:*:* Versions 1.7.6 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.8.1:*:*:*:*:*:*:* Versions 1.8.1 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.8.2:*:*:*:*:*:*:* Versions 1.8.2 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:1.8.3:*:*:*:*:*:*:* Versions 1.8.3 Vulnerable ·Moodle

Remediation

  • Fix · GHSA-v759-3wr5-p294 moodle/moodle (Packagist) Fixed in 1.8.5 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2008-1502
  2. 2026-10-03 Alias added: GHSA-v759-3wr5-p294

References

Exploit 1

Patch 2

Advisory 7

Other 13

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences