Log in Start free

Vulnerability · Published Jul 25, 2022 · Assigned by fedora

CVE-2022-35651

Medium 6.1

In plain English

A medium-severity cross-site scripting in Moodle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)1.1%top 34.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM track details. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistmoodle/moodle3.9.15GHSA-wwv7-h477-wrv7
Packagistmoodle/moodle3.11.8GHSA-wwv7-h477-wrv7
Packagistmoodle/moodle4.0.2GHSA-wwv7-h477-wrv7

Affected products (as reported)

VendorProductVersions
n/a Moodle Fixed in moodle 4.0.2, moodle 3.11.8, moodle 3.9.15

Weakness: CWE-79

References