CVE-2023-5546: Moodle: stored xss in quiz grading report via user id number
ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-5546?
The severity of CVE-2023-5546 is medium with a CVSS score of 5.4.
How does CVE-2023-5546 affect Moodle?
CVE-2023-5546 affects Moodle versions up to 4.0.11, 4.1.6, and 4.2.3, as well as Moodle/Moodle up to version 4.3.0-rc2.
How can I fix CVE-2023-5546 in Moodle?
To fix CVE-2023-5546 in Moodle, make sure to upgrade to version 4.0.11, 4.1.6, 4.2.3, or newer.
Where can I find more information about CVE-2023-5546?
You can find more information about CVE-2023-5546 at the following references: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-78971, https://bugzilla.redhat.com/show_bug.cgi?id=2243445, https://moodle.org/mod/forum/discuss.php?d=451587
What is the CWE category of CVE-2023-5546?
The CWE category of CVE-2023-5546 is CWE-79, which refers to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').