GHSA-9f45-9qrw-pp4v
Moodle vulnerable to Cross-site Scripting when algebra filter enabled but not functional
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | moodle/moodle | >= 4.1.0, < 4.1.2 | 4.1.2 |
| Packagist | moodle/moodle | >= 4.0.0, < 4.0.7 | 4.0.7 |
| Packagist | moodle/moodle | >= 3.11.0, < 3.11.13 | 3.11.13 |
| Packagist | moodle/moodle | < 3.9.20 | 3.9.20 |
Details
As written in the advisory (Markdown source, shown as plain text).
If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2023-28332
- https://github.com/moodle/moodle/commit/9f178c1f816e78ec024ab16a10192c81305b2624
- https://bugzilla.redhat.com/show_bug.cgi?id=2179419
- https://git.moodle.org/gw?p=moodle.git;a=commitdiff;h=9f178c1f816e78ec024ab16a10192c81305b2624
- https://github.com/moodle/moodle
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QZN34VSF4HTCW3C3ZP2OZYSLYUKADPF
- https://lists.fedoraproject.org/archives/list/[email protected]/message/3QZN34VSF4HTCW3C3ZP2OZYSLYUKADPF
- https://moodle.org/mod/forum/discuss.php?d=445064