~ / search / GHSA-q2x3-2f9g-h559

GHSA-q2x3-2f9g-h559

Moodle's Mustache pix helper contained a potential Mustache injection risk if combined with user input

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-28333

Packages

EcosystemPackageAffectedFixed in
Packagist moodle/moodle >= 4.1.0, < 4.1.2 4.1.2
Packagist moodle/moodle >= 4.0.0, < 4.0.7 4.0.7
Packagist moodle/moodle >= 3.11.0, < 3.11.13 3.11.13
Packagist moodle/moodle < 3.9.20 3.9.20

Details

As written in the advisory (Markdown source, shown as plain text).

The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhere in the core Moodle LMS).

References

External links from the advisory. They lead to third-party sites.