CVE-2023-28332: Moodle: algebra filter xss when filter is misconfigured
Published Mar 17, 2023
·Updated
If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk.
Affected Software
16 affected componentsFixes available
redhat/moodle<4.1.2
4.1.2
redhat/moodle<4.0.7
4.0.7
redhat/moodle<3.11.13
3.11.13
redhat/moodle<3.9.20
3.9.20
composer/moodle/moodle<3.9.20
3.9.20
composer/moodle/moodle>=3.11.0<3.11.13
3.11.13
composer/moodle/moodle>=4.0.0<4.0.7
4.0.7
composer/moodle/moodle>=4.1.0<4.1.2
4.1.2
Moodle moodle>3.9.0<3.9.20
Moodle moodle>3.11.0<3.11.13
Moodle moodle>4.0.0<4.0.7
Moodle moodle=3.9.0
Moodle moodle=3.11.0
Moodle moodle=4.0.0
Moodle moodle=4.1.0
Moodle moodle=4.1.1
Remediation
Patch Available
Event History
Mar 23, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Advisory Published
via GitHub·09:30 PM
Frequently Asked Questions
1
What is CVE-2023-28332?
CVE-2023-28332 is a vulnerability in Moodle that allowed for XSS attacks when the algebra filter was enabled but not functional.
2
How does CVE-2023-28332 impact Moodle?
CVE-2023-28332 presented an XSS risk in Moodle if the algebra filter was enabled but not functional.
3
What is the severity of CVE-2023-28332?
CVE-2023-28332 has a severity value of 6.1, which is classified as medium.
4
Which versions of Moodle are affected by CVE-2023-28332?
Moodle versions 3.9.0 to 3.9.20, 3.11.0 to 3.11.13, 4.0.0 to 4.0.7, 4.1.0, and 4.1.1 are affected by CVE-2023-28332.
5
How can I mitigate the risk of CVE-2023-28332?
To mitigate the risk of CVE-2023-28332, ensure that the necessary binaries for the algebra filter are present on the server.