CVE-2022-35653: XSS
A minor reflected XSS risk was identified in the LTI module. This did not impact authenticated users.
Versions affected: 4.0 to 4.0.1, 3.11 to 3.11.7, 3.9 to 3.9.14 and earlier unsupported versions Versions fixed: 4.0.2, 3.11.8 and 3.9.15
Other sources
A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks. This vulnerability does not impact authenticated users.
— GitHub
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this Moodle LTI module XSS issue?
The vulnerability ID for this Moodle LTI module XSS issue is CVE-2022-35653.
What is the severity of CVE-2022-35653?
The severity of CVE-2022-35653 is medium.
How does the vulnerability CVE-2022-35653 occur?
The vulnerability CVE-2022-35653 occurs due to insufficient sanitization of user-supplied data in the LTI module of Moodle.
What is the impact of CVE-2022-35653?
The impact of CVE-2022-35653 is that a remote attacker can trick the victim to execute arbitrary HTML and script code in the user's browser.
How can I fix the vulnerability CVE-2022-35653?
To fix the vulnerability CVE-2022-35653, update Moodle to version 3.9.15, 3.11.8, or 4.0.2.