CVE-2023-28332: Moodle vulnerable to Cross-site Scripting when algebra filter enabled but not functional
If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk.
Other sources
Moodle vulnerable to Cross-site Scripting when algebra filter enabled but not functional
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 4.1.2 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 4.0.7 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 3.11.13 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 3.9.20 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.9.20 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.11.13 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.0.7 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.1.2
Event History
Frequently Asked Questions
What is CVE-2023-28332?
CVE-2023-28332 is a vulnerability in Moodle that allowed for XSS attacks when the algebra filter was enabled but not functional.
How does CVE-2023-28332 impact Moodle?
CVE-2023-28332 presented an XSS risk in Moodle if the algebra filter was enabled but not functional.
What is the severity of CVE-2023-28332?
CVE-2023-28332 has a severity value of 6.1, which is classified as medium.
Which versions of Moodle are affected by CVE-2023-28332?
Moodle versions 3.9.0 to 3.9.20, 3.11.0 to 3.11.13, 4.0.0 to 4.0.7, 4.1.0, and 4.1.1 are affected by CVE-2023-28332.
How can I mitigate the risk of CVE-2023-28332?
To mitigate the risk of CVE-2023-28332, ensure that the necessary binaries for the algebra filter are present on the server.