Log in Start free

Vulnerability · Published May 18, 2022 · Assigned by fedora

CVE-2022-30596

Medium 5.4

In plain English

A medium-severity cross-site scripting in moodle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.4Medium
Exploit odds (30 days)0.9%top 40.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistmoodle/moodle4.0.1GHSA-wvh5-78h5-gmgr
Packagistmoodle/moodle3.11.7GHSA-wvh5-78h5-gmgr
Packagistmoodle/moodle3.10.11GHSA-wvh5-78h5-gmgr
Packagistmoodle/moodle3.9.14GHSA-wvh5-78h5-gmgr

Affected products (as reported)

VendorProductVersions
n/a moodle Affects : 4.0, 3.11 to 3.11.6, 3.10 to 3.10.10, 3.9 to 3.9.13 and earlier unsupported versions

Weakness: CWE-79

References