CVE-2023-28331: Moodle vulnerable to Cross-site Scripting
Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk.
Other sources
Moodle vulnerable to Cross-site Scripting
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 4.1.2 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 4.0.7 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 3.11.13 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 3.9.20 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.9.20 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.11.13 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.0.7 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.1.2
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2023-28331.
What is the severity level of CVE-2023-28331?
The severity level of CVE-2023-28331 is medium, with a severity value of 6.1.
Which software versions are affected by CVE-2023-28331?
Moodle versions 3.9.0 to 3.9.20, 3.11.0 to 3.11.13, 4.0.0 to 4.0.7, 4.1.0, and 4.1.1 are affected by CVE-2023-28331.
What is the risk associated with CVE-2023-28331?
CVE-2023-28331 is an XSS vulnerability that can be exploited through the database auto-linking filter, posing a risk to the integrity of the content.
How can I mitigate or fix CVE-2023-28331?
To mitigate or fix CVE-2023-28331, it is recommended to apply the necessary additional sanitization to the content output by the database auto-linking filter.