CVE-2022-35653

🗓️ 25 Jul 2022 15:33:11Reported by fedoraType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 146 Views

A reflected XSS issue in Moodle LTI module allows remote attacker to execute arbitrary code in user's browse

Reporter	Title	Published	Views	Family All 63
ATTACKERKB	CVE-2022-35653	25 Jul 202216:15	–	attackerkb
Circl	CVE-2022-35653	25 Jul 202220:33	–	circl
CNNVD	Moodle 跨站脚本漏洞	19 Jul 202200:00	–	cnnvd
CNVD	Moodle Cross-Site Scripting Vulnerability (CNVD-2022-54914)	21 Jul 202200:00	–	cnvd
Cvelist	CVE-2022-35653	25 Jul 202215:33	–	cvelist
Fedora	[SECURITY] Fedora 36 Update: moodle-3.11.8-1.fc36	27 Jul 202202:24	–	fedora
Fedora	[SECURITY] Fedora 35 Update: moodle-3.11.8-1.fc35	27 Jul 202202:35	–	fedora
Github Security Blog	Moodle LTI module reflected XSS risk	26 Jul 202200:00	–	github
Hacker One	U.S. Dept Of Defense: Reflected XSS via Moodle on ███ [CVE-2022-35653]	2 Apr 202400:06	–	hackerone
Nuclei	Moodle LTI module Reflected - Cross-Site Scripting	5 Jun 202603:02	–	nuclei

NVD

Node

moodle moodleRange3.9.0–3.9.15

moodle moodleRange3.11.0–3.11.8

moodle moodleMatch4.0.0-

moodle moodleMatch4.0.0beta

moodle moodleMatch4.0.0rc1

moodle moodleMatch4.0.0rc2

moodle moodleMatch4.0.0rc3

moodle moodleMatch4.0.0rc4

moodle moodleMatch4.0.1

Node

fedoraproject fedoraMatch35

fedoraproject fedoraMatch36

Node

redhat enterprise_linuxMatch8.0

[
  {
    "product": "Moodle",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed in moodle 4.0.2, moodle 3.11.8, moodle 3.9.15"
      }
    ]
  }
]

Source	Link
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6MOKYVRNFNAODP2XSMGJ5CRDUZCZKAR3/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTKUSFPSYFINSQFSOHDQIDVE6FWBEU6V/
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
moodle	www.moodle.org/mod/forum/discuss.php
git	www.git.moodle.org/gw