GHSA-mhf6-pp52-8wqj
Moodle Cross-site Scripting (XSS) vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2025-67849
- Aliases
- BIT-moodle-2025-67849
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Description
A flaw was found in Moodle. This Cross-site Scripting (XSS) vulnerability, caused by improper sanitization of AI prompt responses, allows attackers to inject malicious HTML or script into web pages. When other users view these compromised pages, their sessions could be stolen, or the user interface could be manipulated.
Affected packages
| Package | Versions |
|---|---|
| Packagist · moodle/moodle | introduced 0, fixed 4.1.22 |
| Packagist · moodle/moodle | introduced 4.4.0-beta, fixed 4.4.12 |
| Packagist · moodle/moodle | introduced 4.5.0-beta, fixed 4.5.8 |
| Packagist · moodle/moodle | introduced 5.0.0-beta, fixed 5.0.4 |
| Packagist · moodle/moodle | introduced 5.1.0-beta, fixed 5.1.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-67849 ADVISORY
- https://github.com/moodle/moodle/commit/a3063dcaa44dbe66e60a37cadb33bfadfe4feb03 WEB
- https://access.redhat.com/security/cve/CVE-2025-67849 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2423835 WEB
- https://github.com/moodle/moodle PACKAGE
- https://moodle.org/mod/forum/discuss.php?d=471299 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |