6.1

CVE-2022-35653

A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks. This vulnerability does not impact authenticated users.

Data is provided by the National Vulnerability Database (NVD)
Moodle ≫ Moodle Version >= 3.9.0 < 3.9.15
Moodle ≫ Moodle Version >= 3.11.0 < 3.11.8
Moodle ≫ Moodle Version4.0.0 Update-
Moodle ≫ Moodle Version4.0.0 Updatebeta
Moodle ≫ Moodle Version4.0.0 Updaterc1
Moodle ≫ Moodle Version4.0.0 Updaterc2
Moodle ≫ Moodle Version4.0.0 Updaterc3
Moodle ≫ Moodle Version4.0.0 Updaterc4
Moodle ≫ Moodle Version4.0.1
Fedoraproject ≫ Fedora Version35
Fedoraproject ≫ Fedora Version36
Redhat ≫ Enterprise Linux Version8.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 77.99% 0.99
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://bugzilla.redhat.com/show_bug.cgi?id=2106277
Third Party Advisory
Issue Tracking