CVE-2023-5541: Moodle Cross-site Scripting vulnerability
Moodle Cross-site Scripting vulnerability
Other sources
The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.3.0-rc2 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 4.2.3 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 4.1.6 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 4.0.11 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 3.11.17 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 3.9.24 - Compensating control
Verify the contents and trustworthiness of grade spreadsheets before importing them with Moodle's CSV grade import method.
Event History
Frequently Asked Questions
What is CVE-2023-5541?
CVE-2023-5541 is a vulnerability in the CSV grade import method in Moodle that allows for XSS attacks.
What is the severity of CVE-2023-5541?
The severity of CVE-2023-5541 is medium, with a CVSS score of 6.1.
How does CVE-2023-5541 impact Moodle users?
CVE-2023-5541 can be exploited by importing a spreadsheet with unsafe content, potentially leading to XSS attacks.
Which versions of Moodle are affected by CVE-2023-5541?
Moodle versions 3.9.0 to 3.9.24, 3.11.0 to 3.11.17, 4.0.0 to 4.0.11, 4.1.0 to 4.1.6, and 4.2.0 to 4.2.3 are affected by CVE-2023-5541.
How can CVE-2023-5541 be fixed?
To fix CVE-2023-5541, update Moodle to version 3.9.25, 3.11.18, 4.0.12, 4.1.7, or 4.2.4, or apply the corresponding patch provided by Red Hat.