Moodle XSS Vulnerability
High severity
GitHub Reviewed
Published
May 13, 2022
to the GitHub Advisory Database
•
Updated Oct 6, 2023
Package
Affected versions
>= 3.5.0, < 3.5.1
>= 3.4.0, < 3.4.4
>= 3.3.0, < 3.3.7
>= 3.2.0, < 3.2.10
>= 3.1.0, < 3.1.13
Patched versions
3.5.1
3.4.4
3.3.7
3.2.10
3.1.13
Description
Published by the National Vulnerability Database
Jul 10, 2018
Published to the GitHub Advisory Database
May 13, 2022
Reviewed
Jul 20, 2023
Last updated
Oct 6, 2023
A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. When a quiz question bank is imported, it was possible for the question preview that is displayed to execute JavaScript that is written into the question bank.
References