Cross Site Scripting (XSS)

🗓️ 26 Jul 2022 16:40:51Reported by Veracode Vulnerability DatabaseType

Moodle is vulnerable to Cross Site Scripting, allowing data exfiltration via LTI module input.

Reporter	Title	Published	Views	Family All 67
attackerkb	CVE-2022-35653	25 Jul 202216:15	–	attackerkb
BDU FSTEC	Moodle LTI Module Phishing Information Disclosure	10 Aug 202200:00	–	bdu_fstec
Circl	CVE-2022-35653	25 Jul 202220:33	–	circl
CNNVD	Moodle 跨站脚本漏洞	19 Jul 202200:00	–	cnnvd
CNVD	Moodle Cross-Site Scripting Vulnerability (CNVD-2022-54914)	21 Jul 202200:00	–	cnvd
CVE	CVE-2022-35653	25 Jul 202215:33	–	cve
Cvelist	CVE-2022-35653	25 Jul 202215:33	–	cvelist
Fedora	[SECURITY] Fedora 36 Update: moodle-3.11.8-1.fc36	27 Jul 202202:24	–	fedora
Fedora	[SECURITY] Fedora 35 Update: moodle-3.11.8-1.fc35	27 Jul 202202:35	–	fedora
Github Security Blog	Moodle LTI module reflected XSS risk	26 Jul 202200:00	–	github

Vulners

Node

moodle moodle/moodleRangev3.11.0-beta–3.11.0-betaphp

moodle moodle/moodleRangev4.0.0-beta–4.0.0-betaphp

moodle moodle/moodleRangev3.9.0-beta–3.9.0-betaphp

Source	Link
moodle	www.moodle.org/mod/forum/discuss.php
github	www.github.com/moodle/moodle/commit/f1c0f2849bae856de40499589d47ccab775c90df
github	www.github.com/moodle/moodle/commit/77a1413fa055a5e9af40225f6cbcbce26537a283
github	www.github.com/moodle/moodle/commit/b327defe5d2bca62929accd59c0e10b449df73bd
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/MTKUSFPSYFINSQFSOHDQIDVE6FWBEU6V/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTKUSFPSYFINSQFSOHDQIDVE6FWBEU6V/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6MOKYVRNFNAODP2XSMGJ5CRDUZCZKAR3/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/6MOKYVRNFNAODP2XSMGJ5CRDUZCZKAR3/
git	www.git.moodle.org/gw
bugzilla	www.bugzilla.redhat.com/show_bug.cgi

07 Nov 2023 22:08Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.16.1

EPSS0.04842