Not rated
CVE-2022-35653 A reflected XSS issue was identified in the LTI module of Moodle
Description
A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks. This vulnerability does not impact authenticated users.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Moodle | Versions not published |
References
- bugzilla.redhat.com bugzilla.redhat.com
- moodle.org moodle.org
- git.moodle.org git.moodle.org
- FEDORA-2022-81ce74b2dd lists.fedoraproject.org
- FEDORA-2022-7e7ce7df2e lists.fedoraproject.org
Timeline
- Published
- Last modified
Other CVEs of Moodle
The 89 CVEs of Moodle →
CVE-2022-40208
In Moodle, insufficient limitations in some quiz web services made it possible for students to bypass sequential…
4.3
Medium
CVE-2021-36402
In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration…
5.3
Medium
CVE-2021-36395
In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion…
7.5
High
CVE-2021-36392
In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses
Not rated