Moodle: moodle: cross-site scripting vulnerability via inadequate input filtering in formula editor (moodle)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.31 % · percentile 23 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- fedora
- NVD status
- Analyzed
Description
A flaw was found in moodle. This vulnerability, known as Cross-Site Scripting (XSS), occurs due to insufficient checks on user-provided data in the formula editor's arithmetic expression fields. A remote attacker could inject malicious code into these fields. When other users view these expressions, the malicious code would execute in their web browsers, potentially compromising their data or leading to unauthorized actions.
Weaknesses (CWE)
- CWE-79 — Improper Neutralization of Input During Web Page Generation
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N | fedora |
| CVSS 3.1 | HIGH 7.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N | NVD · patrick@puiterwijk.org (Secondary) |
| CVSS 3.1 | MEDIUM 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-6mmv-f6c6-v6q8 — Moodle vulnerable to Cross-site Scripting
European references
- ENISA EUVD · EUVD-2025-206736
- GCVE · GCVE-0-2025-67850
CERT-FR advisories
- CERTFR-2025-AVI-1113 — Multiples vulnérabilités dans Moodle · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*< 4.1.22cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*≥ 4.4.0 < 4.4.11cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*≥ 4.5.0 < 4.5.8cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*≥ 5.0.0 < 5.0.4cpe:2.3:a:moodle:moodle:5.1.0:-:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| moodle | affected 4.1.0 < 4.1.22 ; affected 4.4.0 < 4.4.12 ; affected 4.5.0 < 4.5.8 ; affected 5.0.0 < 5.0.4 ; affected 5.1.0 < 5.1.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |