REDHAT-BUG-2128146: XSS
First published: Tue Sep 20 2022(Updated: )
Severity/Risk: Serious Versions affected: 4.0 to 4.0.3, 3.11 to 3.11.9, 3.9 to 3.9.16 and earlier unsupported versions Versions fixed: 4.0.4, 3.11.10 and 3.9.17 Reported by: Adam Roberts, NCC Group CVE identifier: <a href="https://access.redhat.com/security/cve/CVE-2022-40313">CVE-2022-40313</a> Changes (master): <a href="http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-68066">http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-68066</a> Tracker issue: MDL-68066 Stored XSS and page denial of service risks due to recursive rendering in Mustache template helpers
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Moodle | >=4.0<=4.0.3>=3.11<=3.11.9>=3.9<=3.9.16 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2022-40313
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-68066
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2128148
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2128149
- https://bugzilla.redhat.com/show_bug.cgi?id=2128146
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-40313
- agent/weakness
- agent/references
- agent/severity
- agent/event
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/moodle
- canonical/moodle