GHSA-fwfj-8p36-rc64

Moodle vulnerable to Cross-site Scripting

At a glance

Published: 2023-06-22 21:30 UTC
Updated: 2024-04-19 16:34 UTC
CVE: CVE-2023-35131
Aliases: BIT-moodle-2023-35131
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

Content on the groups page required additional sanitizing to prevent an XSS risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8 and 3.11 to 3.11.14.

Affected packages

Package	Versions
Packagist · moodle/moodle	introduced 4.2.0, fixed 4.2.1
Packagist · moodle/moodle	introduced 4.1.0, fixed 4.1.4
Packagist · moodle/moodle	introduced 4.0.0, fixed 4.0.9
Packagist · moodle/moodle	introduced 0, fixed 3.11.15

References

https://nvd.nist.gov/vuln/detail/CVE-2023-35131 ADVISORY
https://bugzilla.redhat.com/show_bug.cgi?id=2214369 WEB
https://github.com/moodle/moodle PACKAGE
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC WEB
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT WEB
https://moodle.org/mod/forum/discuss.php?d=447829 WEB
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-76683 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database