Back to feed
EUVD-2022-7467 · Published Nov 23, 2022
Moodle stored-XSS vulnerability in some "social" user profile fields The stored-XSS vulnerability was discovered in Moodle which exists due to insufficient sanitization of user-supplied data in several "social" user profile fields. An attacker could inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Technologies
Moodle MoodleFedoraproject Fedora
Weaknesses
CWE-79
CVSS scores
- v3.15.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access
References
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-76131
- https://bugzilla.redhat.com/show_bug.cgi?id=2142774
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DHYIIAUXUBHMBEDYU7TYNZXEN2W2SA2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74SXNGA5RIWM7QNX7H3G7SYIQLP4UUGV/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLRJB5JNKK3VVBLV3NH3RI7COEDAXSAB/
- https://moodle.org/mod/forum/discuss.php?d=440771
Potentially impacted assets
See if this affects your attack surface
