CVE-2023-5544: Moodle Cross-site Scripting vulnerability
Moodle Cross-site Scripting vulnerability
Other sources
Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.3.0-rc2 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 4.2.3 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 4.1.6 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 4.0.11 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 3.11.17 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 3.9.24 - Compensating control
Apply additional input sanitization and access restrictions to Moodle wiki comments to prevent stored XSS and potential IDOR attacks.
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-5544.
What is the severity of CVE-2023-5544?
The severity of CVE-2023-5544 is medium.
What software is affected by CVE-2023-5544?
The affected software is Moodle version 3.9.0 to 4.2.3 and Redhat Enterprise Linux 7.0, Fedoraproject Fedora 37, 38, and 39.
How can I fix the vulnerability CVE-2023-5544?
To fix CVE-2023-5544, you should update Moodle to version 4.2.3 or apply the recommended patches for your specific version, and follow the guidelines provided by Moodle on their website.
Where can I find more information about CVE-2023-5544?
You can find more information about CVE-2023-5544 on the Moodle website, Git repository, and the Redhat Bugzilla entry.