7.3

CVE-2025-67850

Moodle: moodle: cross-site scripting vulnerability via inadequate input filtering in formula editor

XSS risk in formula editor

A flaw was found in moodle. This vulnerability, known as Cross-Site Scripting (XSS), occurs due to insufficient checks on user-provided data in the formula editor's arithmetic expression fields. A remote attacker could inject malicious code into these fields. When other users view these expressions, the malicious code would execute in their web browsers, potentially compromising their data or leading to unauthorized actions.
Mögliche Gegenmaßnahme
Moodle Server: Update to a patched version.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Moodle ≫ Moodle Version < 4.1.22
Moodle ≫ Moodle Version >= 4.4.0 < 4.4.11
Moodle ≫ Moodle Version >= 4.5.0 < 4.5.8
Moodle ≫ Moodle Version >= 5.0.0 < 5.0.4
Moodle ≫ Moodle Version5.1.0 Update-
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Weitere Schwachstelleninformationen
SystemMoodle
≫
Produkt Moodle Server
Version < 4.1.0
Version >= 5.1.0, < 5.1.1
Version >= 5.0.0, < 5.0.4
Version >= 4.5.0, < 4.5.8
Version >= 4.4.0, < 4.4.12
Version >= 4.1.0, < 4.1.22
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.02% 0.068
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
patrick@puiterwijk.org 7.3 2.1 5.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://bugzilla.redhat.com/show_bug.cgi?id=2423838
Third Party Advisory
Issue Tracking