Log in Start free

Vulnerability · Published Jul 25, 2022 · Assigned by fedora

CVE-2022-35653

Medium 6.1

In plain English

A medium-severity cross-site scripting in Moodle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.8% (higher than 92% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)4.8%top 8.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei

Official description

A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks. This vulnerability does not impact authenticated users.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistmoodle/moodle4.0.2GHSA-62wh-m4jr-233r
Packagistmoodle/moodle3.11.8GHSA-62wh-m4jr-233r
Packagistmoodle/moodle3.9.15GHSA-62wh-m4jr-233r

Affected products (as reported)

VendorProductVersions
n/a Moodle Fixed in moodle 4.0.2, moodle 3.11.8, moodle 3.9.15

Weakness: CWE-79

References