CVE-2024-28593: XSS
The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance degradation. NOTE: the vendor's UsingChat page says "If you know some HTML code, you can use it in your text to do things like insert images, play sounds or create different coloured and sized text." This page also says "Chat is due to be removed from standard Moodle."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-28593?
CVE-2024-28593 has a moderate severity as it may lead to performance degradation in Moodle.
How do I fix CVE-2024-28593?
To address CVE-2024-28593, it is recommended to update to Moodle version 4.3.4 or later.
Which versions of Moodle are affected by CVE-2024-28593?
CVE-2024-28593 affects Moodle version 4.3.3 and earlier.
What kind of content is exploited in CVE-2024-28593?
CVE-2024-28593 allows the insertion of unwanted HTML elements such as A and IMG tags.
Can CVE-2024-28593 impact user experience?
Yes, CVE-2024-28593 can lead to performance degradation, negatively affecting user experience in the Chat activity.