GitHub Advisoryadvisory · Packagist

GHSA-fwfj-8p36-rc64 Moodle vulnerable to Cross-site Scripting

MEDIUM Published 2023-06-22 Modified 2024-04-19 Official page ↗
Aliases
CVE-2023-35131
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-06-23

Affected packages

• Packagist moodle/moodle: >= 4.2.0, < 4.2.1 → fixed in 4.2.1 • Packagist moodle/moodle: >= 4.1.0, < 4.1.4 → fixed in 4.1.4 • Packagist moodle/moodle: >= 4.0.0, < 4.0.9 → fixed in 4.0.9 • Packagist moodle/moodle: < 3.11.15 → fixed in 3.11.15

Description

Content on the groups page required additional sanitizing to prevent an XSS risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8 and 3.11 to 3.11.14.

Related

Alias · CVE (1)

  • CVE-2023-35131 Content on the groups page required additional sanitizing to prevent an XSS risk. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References