GoogleOSV:GHSA-XV72-6PGH-CJJ8Moodle stored-XSS vulnerability in some "social" user profile fields
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
7.4 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
44.4%
The stored-XSS vulnerability was discovered in Moodle which exists due to insufficient sanitization of user-supplied data in several “social” user profile fields. An attacker could inject and execute arbitrary HTML and script code in user’s browser in context of vulnerable website.
References
git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-76131
bugzilla.redhat.com/show_bug.cgi?id=2142774
github.com/moodle/moodle
lists.fedoraproject.org/archives/list/[email protected]/message/2DHYIIAUXUBHMBEDYU7TYNZXEN2W2SA2
lists.fedoraproject.org/archives/list/[email protected]/message/74SXNGA5RIWM7QNX7H3G7SYIQLP4UUGV
lists.fedoraproject.org/archives/list/[email protected]/message/NLRJB5JNKK3VVBLV3NH3RI7COEDAXSAB
moodle.org/mod/forum/discuss.php?d=440771
nvd.nist.gov/vuln/detail/CVE-2022-45151
Related
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
7.4 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
44.4%