CVE-2022-35651: Moodle Stored XSS and blind SSRF possible via SCORM track details
A stored Cross-site Scripting (XSS) and blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM track details. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks.
Other sources
A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM track details. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks.
— NVD
Insufficient sanitizing of SCORM track details presented stored XSS and blind SSRF risks.
Versions affected: 4.0 to 4.0.1, 3.11 to 3.11.7, 3.9 to 3.9.14 and earlier unsupported versions Versions fixed: 4.0.2, 3.11.8 and 3.9.15
— Red Hat
Moodle Stored XSS and blind SSRF possible via SCORM track details
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.0.2 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.11.8 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.9.15 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 4.0.2 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 3.11.8 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 3.9.15 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 4.0.2 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 3.11.8 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 3.9.15
Event History
Frequently Asked Questions
What is CVE-2022-35651?
CVE-2022-35651 is a stored XSS and blind SSRF vulnerability found in Moodle.
How does CVE-2022-35651 occur?
CVE-2022-35651 occurs due to insufficient sanitization of user-supplied data in the SCORM track details in Moodle.
What is the severity of CVE-2022-35651?
The severity of CVE-2022-35651 is high, with a severity value of 6.1.
Which versions of Moodle are affected by CVE-2022-35651?
Moodle versions 3.9.0 to 3.9.15 and 3.11.0 to 3.11.8 are affected by CVE-2022-35651.
How can I fix CVE-2022-35651?
To fix CVE-2022-35651, update Moodle to version 3.9.15 or 3.11.8, or apply the provided patches.