CVE-2024-28593: XSS
First published: Fri Mar 22 2024(Updated: )
The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance degradation. NOTE: the vendor's Using_Chat page says "If you know some HTML code, you can use it in your text to do things like insert images, play sounds or create different coloured and sized text." This page also says "Chat is due to be removed from standard Moodle."
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/moodle/moodle | <=4.3.3 | |
| Moodle | =4.3.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://medium.com/%40lamscun/how-do-i-change-htmli-from-low-to-critical-your-email-box-is-safe-e7171efd88fe
- https://gist.githubusercontent.com/minendie/4f23174687bc4d8eb7f727d9959b5399/raw/9ce573cebcce5521d9d6f826ab68f3780036b874/CVE-2024-28593.txt
- https://docs.moodle.org/403/en/Using_Chat
- https://nvd.nist.gov/vuln/detail/CVE-2024-28593
- https://github.com/advisories/GHSA-f6mh-79vh-2hv7 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2024-28593?
CVE-2024-28593 has a moderate severity as it may lead to performance degradation in Moodle.
How do I fix CVE-2024-28593?
To address CVE-2024-28593, it is recommended to update to Moodle version 4.3.4 or later.
Which versions of Moodle are affected by CVE-2024-28593?
CVE-2024-28593 affects Moodle version 4.3.3 and earlier.
What kind of content is exploited in CVE-2024-28593?
CVE-2024-28593 allows the insertion of unwanted HTML elements such as A and IMG tags.
Can CVE-2024-28593 impact user experience?
Yes, CVE-2024-28593 can lead to performance degradation, negatively affecting user experience in the Chat activity.
- agent/type
- agent/first-publish-date
- agent/description
- agent/references
- agent/author
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/weakness
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-f6mh-79vh-2hv7
- alias/CVE-2024-28593
- agent/software-canonical-lookup
- agent/severity
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- agent/trending
- agent/source
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- agent/event
- package-manager/composer
- vendor/moodle
- canonical/moodle
- version/moodle/4.3.3