medium6.1
CVE-2023-28332
Moodle vulnerable to Cross-site Scripting when algebra filter enabled but not functional
Impact
If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | moodle/moodle | >= 4.1.0, < 4.1.2 | 4.1.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Moodle | Moodle | after 3.9.0 before 3.9.20 after 3.11.0 before 3.11.13 after 4.0.0 before 4.0.7 Versions 3.9.0, 3.11.0, 4.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2179419
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QZN34VSF4HTCW3C3ZP2OZYSLYUKADPF/
- https://moodle.org/mod/forum/discuss.php?d=445064
- https://github.com/advisories/GHSA-9f45-9qrw-pp4v
- https://nvd.nist.gov/vuln/detail/CVE-2023-28332
- https://github.com/moodle/moodle/commit/9f178c1f816e78ec024ab16a10192c81305b2624
- https://git.moodle.org/gw?p=moodle.git;a=commitdiff;h=9f178c1f816e78ec024ab16a10192c81305b2624
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QZN34VSF4HTCW3C3ZP2OZYSLYUKADPF
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3QZN34VSF4HTCW3C3ZP2OZYSLYUKADPF