GHSA-xhfw-wjjc-4j5h
Moodle Cross-site Scripting
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | moodle/moodle | >= 3.1, < 3.1.12 | 3.1.12 |
| Packagist | moodle/moodle | >= 3.2, < 3.2.9 | 3.2.9 |
| Packagist | moodle/moodle | >= 3.3, < 3.3.6 | 3.3.6 |
| Packagist | moodle/moodle | >= 3.4, < 3.4.3 | 3.4.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is visible to this user only. Through this security vulnerability, users can move such a block to other pages where they can be viewed by other users.
References
External links from the advisory. They lead to third-party sites.