GHSA-fwfj-8p36-rc64
Moodle vulnerable to Cross-site Scripting
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2023-35131
- Alias
- BIT-moodle-2023-35131
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Description
Content on the groups page required additional sanitizing to prevent an XSS risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8 and 3.11 to 3.11.14.
Paquets affectés
| Paquet | Versions |
|---|---|
| Packagist · moodle/moodle | introduced 4.2.0, fixed 4.2.1 |
| Packagist · moodle/moodle | introduced 4.1.0, fixed 4.1.4 |
| Packagist · moodle/moodle | introduced 4.0.0, fixed 4.0.9 |
| Packagist · moodle/moodle | introduced 0, fixed 3.11.15 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2023-35131 ADVISORY
- https://bugzilla.redhat.com/show_bug.cgi?id=2214369 WEB
- https://github.com/moodle/moodle PACKAGE
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC WEB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT WEB
- https://moodle.org/mod/forum/discuss.php?d=447829 WEB
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-76683 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |