CVE-2022-35651: XSS
A stored Cross-site Scripting (XSS) and blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM track details. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks.
Other sources
A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM track details. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks.
— NVD
Insufficient sanitizing of SCORM track details presented stored XSS and blind SSRF risks.
Versions affected: 4.0 to 4.0.1, 3.11 to 3.11.7, 3.9 to 3.9.14 and earlier unsupported versions Versions fixed: 4.0.2, 3.11.8 and 3.9.15
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-35651?
CVE-2022-35651 is a stored XSS and blind SSRF vulnerability found in Moodle.
How does CVE-2022-35651 occur?
CVE-2022-35651 occurs due to insufficient sanitization of user-supplied data in the SCORM track details in Moodle.
What is the severity of CVE-2022-35651?
The severity of CVE-2022-35651 is high, with a severity value of 6.1.
Which versions of Moodle are affected by CVE-2022-35651?
Moodle versions 3.9.0 to 3.9.15 and 3.11.0 to 3.11.8 are affected by CVE-2022-35651.
How can I fix CVE-2022-35651?
To fix CVE-2022-35651, update Moodle to version 3.9.15 or 3.11.8, or apply the provided patches.