CVE-2023-5541: Moodle: xss risk when using csv grade import method
Published Oct 11, 2023
·Updated
The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.
Affected Software
11 affected componentsFixes available
composer/moodle/moodle<4.3.0-rc2
4.3.0-rc2
redhat/moodle<4.2.3
4.2.3
redhat/moodle<4.1.6
4.1.6
redhat/moodle<4.0.11
4.0.11
redhat/moodle<3.11.17
3.11.17
redhat/moodle<3.9.24
3.9.24
Moodle moodle>=3.9.0<3.9.24
Moodle moodle>=3.11.0<3.11.17
Moodle moodle>=4.0.0<4.0.11
Moodle moodle>=4.1.0<4.1.6
Moodle moodle>=4.2.0<4.2.3
Remediation
Patch Available
Event History
Nov 9, 2023
CVE Published
via MITRE·07:18 PM
Data Sourced
via MITRE·07:18 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Advisory Published
09:30 PM
Frequently Asked Questions
1
What is CVE-2023-5541?
CVE-2023-5541 is a vulnerability in the CSV grade import method in Moodle that allows for XSS attacks.
2
What is the severity of CVE-2023-5541?
The severity of CVE-2023-5541 is medium, with a CVSS score of 6.1.
3
How does CVE-2023-5541 impact Moodle users?
CVE-2023-5541 can be exploited by importing a spreadsheet with unsafe content, potentially leading to XSS attacks.
4
Which versions of Moodle are affected by CVE-2023-5541?
Moodle versions 3.9.0 to 3.9.24, 3.11.0 to 3.11.17, 4.0.0 to 4.0.11, 4.1.0 to 4.1.6, and 4.2.0 to 4.2.3 are affected by CVE-2023-5541.
5
How can CVE-2023-5541 be fixed?
To fix CVE-2023-5541, update Moodle to version 3.9.25, 3.11.18, 4.0.12, 4.1.7, or 4.2.4, or apply the corresponding patch provided by Red Hat.